package main
import (
"fmt"
"html/template"
"net/http"
"strconv"
)
func Fine(r *http.Request) template.HTML {
// ok: unsafe-template-type
return template.HTML("Hello, world
")
}
func AlsoFine(r *http.Request) template.HTML {
// ok: unsafe-template-type
return template.HTML("" + "Hello, world
")
}
func OthersThatAreFine(r *http.Request) template.HTML {
// ok: unsafe-template-type
a := template.HTMLAttr("Hello, world
")
// ok: unsafe-template-type
a := template.JS("Hello, world
")
// ok: unsafe-template-type
a := template.URL("Hello, world
")
// ok: unsafe-template-type
a := template.CSS("Hello, world
")
// ok: unsafe-template-type
a := template.Srcset("Hello, world
")
}
func OthersThatAreNOTFine(r *http.Request, data string) template.HTML {
// ruleid: unsafe-template-type
a := template.HTMLAttr(fmt.Sprintf("%s
", data))
// ruleid: unsafe-template-type
a := template.JS(fmt.Sprintf("%s
", data))
// ruleid: unsafe-template-type
a := template.URL(fmt.Sprintf("%s
", data))
// ruleid: unsafe-template-type
a := template.CSS(fmt.Sprintf("%s
", data))
// ruleid: unsafe-template-type
a := template.Srcset(fmt.Sprintf("%s
", data))
}
func Concat(r *http.Request) template.HTML {
customerId := r.URL.Query().Get("id")
tmpl := "" + customerId + "
"
// ruleid: unsafe-template-type
return template.HTML(tmpl)
}
func ConcatBranch(r *http.Request) template.HTML {
customerId := r.URL.Query().Get("id")
doIt, err := strconv.ParseBool(r.URL.Query().Get("do"))
if err != nil {
return template.HTML("")
}
var tmpl string
if doIt {
tmpl = "" + customerId + "
"
} else {
tmpl = ""
}
// ruleid: unsafe-template-type
return template.HTML(tmpl)
}
func ConcatInline(r *http.Request) template.HTML {
customerId := r.URL.Query().Get("id")
// ruleid: unsafe-template-type
return template.HTML("" + customerId + "
")
}
func ConcatInlineOneside(r *http.Request) template.HTML {
customerId := r.URL.Query().Get("id")
// ruleid: unsafe-template-type
return template.HTML("" + customerId)
}
func Formatted(r *http.Request) template.HTML {
customerId := r.URL.Query().Get("id")
tmpl, err := fmt.Printf("%s
", customerId)
if err != nil {
return template.HTML("")
}
// ruleid: unsafe-template-type
return template.HTML(tmpl)
}
func FormattedInline(r *http.Request) template.HTML {
customerId := r.URL.Query().Get("id")
// ruleid: unsafe-template-type
return template.HTML(fmt.Sprintf("%s
", customerId))
}
func main() {}