Server-Side Template Injection
Description
User input passed directly to template.Parse without sanitization.
How to fix
Use predefined templates and pass user data as template variables.
```go
tmpl := template.Must(template.ParseFiles("page.html"))
tmpl.Execute(w, map[string]string{
"name": userInput, // Safe - passed as data, not template code
})
```
Learn more: https://shoulder.dev/learn/go/cwe-94/ssti
Applies to
Languages
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=go-ssti .
Real-world examples
Known CVEs in the Code Injection vulnerability class that this rule helps detect.