contribs/gnodev/pkg/emitter: use html/template not text/template to avoid any HTML serving issues or future unescaped XSS attacks: minor

[odeke-em]

This is a currently minor issue given that the code inside middleware.go is not attacker controlled but really when starting up a server

gno/contribs/gnodev/pkg/emitter/middleware.go

Line 24 in d2813f8

tmpl *template.Template

gno/contribs/gnodev/pkg/emitter/middleware.go

Lines 86 to 89 in d2813f8

	err := m.tmpl.Execute(script, &data{
	Remote: m.remote,
	ReloadEvents: []events.Type{
	events.EvtReload, events.EvtReset, events.EvtTxResult,

but it is best practice to using html/template not text/template for any HTML related code. Cross site scripting (XSS) attacks occur when injected code is not correctly escaped and I gave a proof of concept for the dangers of using text/template instead of html/template at https://cyber.orijtech.com/advisory/go-xss-concat-text-template

Exhibit

If an attacker ever got a hold of .RemoteAddr before it was generated or if the scripts evolved to later allow user input here is an exhibit of how text/template can go awry https://go.dev/play/p/dTAacWXE9uC

package main

import (
	htmltmpl "html/template"
	"os"
	texttmpl "text/template"
)

var naiveTmpl = texttmpl.Must(texttmpl.New("reloadscript").Parse("const ws = new WebSocket('ws://{{- .Remote -}}');"))
var goodTmpl = htmltmpl.Must(htmltmpl.New("reloadscript").Parse("const ws = new WebSocket('ws://{{- .Remote -}}');"))

func main() {
	m := map[string]string{
		"Remote": `localhost:9999');alert('pwned`,
	}

	_ = naiveTmpl.Execute(os.Stdout, m)
	println("")
	_ = goodTmpl.Execute(os.Stdout, m)
}

which when ran produces

const ws = new WebSocket('ws://localhost:9999');alert('pwned');
const ws = new WebSocket('ws://localhost:9999');alert('pwned');

of which the first one uses text/template and will get your pwned as I can now inject arbitrary code and as a proof of concept will pop up an alert telling you pwned but the imagination can go wild with what you could do

but the html/template code rightfully caught the problem and produced

const ws = new WebSocket('ws://localhost:9999');alert('pwned');

which will fail to connect entirely.