Will It Vibe?Value cast to template.HTML/JS/URL (Go)
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
html/template auto-escapes by context; casting a string to template.HTML (or .JS/.URL/.CSS) turns that protection off, so a user-controlled value cast this way is an XSS vector.
Why it matters
Go html/template escapes output based on context, which stops most XSS automatically. Casting a string to template.HTML, template.JS, or template.URL marks it as already safe and turns escaping off, so a user-controlled value cast this way can inject script. It is a heuristic because the cast value may be a trusted constant.
How to fix it
Let the template escape the value: pass a plain string and use it in the template so html/template applies contextual escaping. Only cast to template.HTML when the content is trusted markup you generated, and sanitize any user-derived HTML with a library such as bluemonday before casting.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo