Secure Go Programming

Learn secure go programming through an executable example, then connect the small demonstration to production code.

Secure programs keep untrusted input separate from code and privileged operations. Common controls include parameterized SQL, contextual HTML escaping, careful file path handling, bounded input and least-privilege credentials.

html/template escapes user-provided content when rendered in ordinary HTML text contexts.

Follow this diagram before executing the example. Check where a value or decision changes what runs next.

Never concatenate untrusted input into SQL statements. Use parameters supported by the database driver; validate authorization independently of HTML escaping.

This example is a complete program. Save it as main.go or paste it into the Go Playground.

Go code

package main

import (
	"bytes"
	"fmt"
	"html/template"
)

func main() {
	page := template.Must(template.New("page").Parse("<p>{{.}}</p>"))
	var result bytes.Buffer
	if err := page.Execute(&result, "<script>alert(1)</script>"); err != nil {
		panic(err)
	}
	fmt.Println(result.String())
}

Output

<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>

The template writes the supplied text as escaped HTML rather than making the script tag executable markup. The output includes HTML character entities.

• Avoid converting user strings to template.HTML; doing so bypasses escaping.
• Template escaping is not a substitute for CSRF protection, authentication or input limits.

Create a template that renders a user name and compare the output for plain text and characters such as < and &.

Tip: Edit the example above, predict the output, and run the modified code to test your reasoning.

You have practiced Secure Go Programming in a small, self-contained program. The important habit is to predict what runs, inspect the actual output and distinguish the language rule from the particular example.

Before continuing, make sure you can explain the program to someone who has not seen it, including the line that changes its result.