1.4 服务器端渲染

1.4.1【必须】模板渲染过滤验证

  • 使用text/template或者html/template渲染模板时禁止将外部输入参数引入模板，或仅允许引入白名单内字符。
  1.    // bad
  2.     func handler(w http.ResponseWriter, r *http.Request) {
  3.       r.ParseForm()
  4.       x := r.Form.Get("name")
  6.       var tmpl = `<!DOCTYPE html><html><body>
  7.     <form action="/" method="post">
  8.         First name:<br>
  9.     <input type="text" name="name" value="">
  10.     <input type="submit" value="Submit">
  11.     </form><p>` + x + ` </p></body></html>`
  13.       t := template.New("main")
  14.       t, _ = t.Parse(tmpl)
  15.       t.Execute(w, "Hello")
  16.     }
  18. // good
  19.     import (
  20.         "fmt"
  21.         "github.com/go-playground/validator/v10"
  22.     )
  24.     var validate *validator.Validate
  25.     validate = validator.New()
  26.     func validateVariable(val) {
  27.         errs := validate.Var(val, "gte=1,lte=100")//限制必须是1-100的正整数
  28.         if errs != nil {
  29.             fmt.Println(errs)
  30.             return False
  31.         }
  32.         return True
  33.     }
  35.     func handler(w http.ResponseWriter, r *http.Request) {
  36.         r.ParseForm()
  37.         x := r.Form.Get("name")
  39.         if validateVariable(x):
  40.             var tmpl = `<!DOCTYPE html><html><body>
  41.             <form action="/" method="post">
  42.             First name:<br>
  43.             <input type="text" name="name" value="">
  44.             <input type="submit" value="Submit">
  45.             </form><p>` + x + ` </p></body></html>`
  46.             t := template.New("main")
  47.             t, _ = t.Parse(tmpl)
  48.             t.Execute(w, "Hello")
  49.         else:
  50.             ...
  51.     }