Commit `35d16226b9`

35d16226b9a4b911c0abf3cf7305b28336028d84

parent: 91ac29cc4c

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-11 02:31 UTC

Escape everything rendered from user or DeviantArt input

Templates now use html/template, so query strings, usernames and titles
are escaped in context. The Go-built fragments (listings, comments,
descriptions, folders, tags, strips, user plates, pagination) escape
each DeviantArt-supplied string themselves and are handed to the
template as template.HTML. The Atom feed shares the same escaping.
ParseDescription's HTML branch emits whitelisted tags bare rather than
with their original attributes.

The 502 page shows only the first line of the upstream error, escaped,
instead of echoing a whole WAF block page.

Closes #13
Closes #19

Layout: unified · split

app/escape_test.go added +150

@@ -0,0 +1,150 @@
	1	package app
	2
	3	import (
	4	"html/template"
	5	"net/http/httptest"
	6	"skunkyart/static"
	7	"strings"
	8	"sync"
	9	"testing"
	10
	11	"github.com/krazywarez/devianter"
	12	)
	13
	14	var loadTemplatesOnce sync.Once
	15
	16	// loadTemplates makes static.Templates usable from a test. The non-embed build
	17	// reads the repository's static/ directory; the embed build already has it.
	18	func loadTemplates() {
	19	loadTemplatesOnce.Do(func() {
	20	static.StaticPath = "../static"
	21	static.CopyTemplatesToMemory()
	22	})
	23	}
	24
	25	// markup is the payload every escaping test injects. It closes an attribute,
	26	// closes a tag and opens a new element, which is what an injection needs to do.
	27	const markup = `"><b id=injected>x</b>`
	28
	29	// TestEveryPageTemplateRenders pins down that the switch to html/template
	30	// parses and executes every page: html/template rejects some constructs
	31	// text/template accepts, and a failure here would be a 500 on every request.
	32	func TestEveryPageTemplateRenders(t *testing.T) {
	33	loadTemplates()
	34	for _, page := range []string{"about.htm", "daily.htm", "deviantion.htm", "gruser.htm", "search.htm"} {
	35	rec := httptest.NewRecorder()
	36	s := skunkyart{Writer: rec, Host: "http://localhost", BasePath: "/"}
	37	s.ExecuteTemplate(page, "html", &s)
	38	if rec.Code != 200 \|\| !strings.Contains(rec.Body.String(), "</html>") {
	39	t.Errorf("%s: status %d, body %q", page, rec.Code, rec.Body.String())
	40	}
	41	}
	42
	43	rec := httptest.NewRecorder()
	44	uri := "/"
	45	skunkyart{Writer: rec}.ExecuteTemplate("index.htm", "html", &uri)
	46	if rec.Code != 200 \|\| !strings.Contains(rec.Body.String(), "</html>") {
	47	t.Errorf("index.htm: status %d, body %q", rec.Code, rec.Body.String())
	48	}
	49	}
	50
	51	// TestSearchPageEscapesTheQuery is the regression test for the reflected
	52	// query: it appears in the search box's value attribute and in the results
	53	// heading, and both must show it as text.
	54	func TestSearchPageEscapesTheQuery(t *testing.T) {
	55	loadTemplates()
	56	rec := httptest.NewRecorder()
	57	s := skunkyart{Writer: rec, Host: "http://localhost", BasePath: "/", Endpoint: "search", QueryRaw: markup}
	58	s.Templates.Search.List = template.HTML("<div></div>")
	59	s.Templates.Search.Content.Total = 1
	60	s.ExecuteTemplate("search.htm", "html", &s)
	61
	62	body := rec.Body.String()
	63	if strings.Contains(body, "<b id=injected>") {
	64	t.Fatalf("query rendered as markup:\n%s", body)
	65	}
	66	if n := strings.Count(body, "<b id=injected>"); n != 3 {
	67	t.Errorf("escaped query appears %d times, want 3 (title, value attribute, heading):\n%s", n, body)
	68	}
	69	}
	70
	71	// TestDeviationListEscapesTitles covers the Go-built listing, which
	72	// html/template cannot escape because it arrives as template.HTML.
	73	func TestDeviationListEscapesTitles(t *testing.T) {
	74	nsfw := CFG.Nsfw
	75	CFG.Nsfw = true
	76	defer func() { CFG.Nsfw = nsfw }()
	77
	78	d := devianter.Deviation{Title: markup}
	79	d.Author.Username = markup
	80	devs := []devianter.Deviation{d}
	81
	82	out := skunkyart{Host: "http://localhost"}.DeviationList(devs, false)
	83	if strings.Contains(out, "<b id=injected>") \|\| !strings.Contains(out, "<b id=injected>") {
	84	t.Errorf("HTML listing did not escape the title:\n%s", out)
	85	}
	86
	87	rec := httptest.NewRecorder()
	88	skunkyart{Host: "http://localhost", Writer: rec, Atom: true}.DeviationList(devs, true)
	89	if feed := rec.Body.String(); strings.Contains(feed, "<b id=injected>") \|\| !strings.Contains(feed, "<b id=injected>") {
	90	t.Errorf("Atom feed did not escape the title:\n%s", feed)
	91	}
	92	}
	93
	94	// TestParseCommentsEscapesUsernames covers the comment thread, where the name
	95	// is written as link text and as the "In reply to" target.
	96	func TestParseCommentsEscapesUsernames(t *testing.T) {
	97	var c devianter.Comments
	98	var parent, reply devianter.Thread
	99	parent.ID = 1
	100	parent.User.Username = markup
	101	reply.ID = 2
	102	reply.Parent = 1
	103	reply.User.Username = "bob"
	104	c.Thread = []devianter.Thread{parent, reply}
	105
	106	out := skunkyart{Host: "http://localhost", _pth: "/post/x/y"}.ParseComments(c, devianter.Error{})
	107	if strings.Contains(out, "<b id=injected>") {
	108	t.Fatalf("username rendered as markup:\n%s", out)
	109	}
	110	if n := strings.Count(out, "<b id=injected>"); n != 4 {
	111	t.Errorf("escaped username appears %d times, want 4 (avatar, link, author, reply target):\n%s", n, out)
	112	}
	113	}
	114
	115	// TestParseDescriptionEscapesMarkupText covers the plain-HTML branch: text is
	116	// escaped, whitelisted tags are kept bare, and anything else is dropped.
	117	func TestParseDescriptionEscapesMarkupText(t *testing.T) {
	118	var d devianter.Text
	119	d.Html.Markup = `a <b class="z">b</b> <script>alert(1)</script> <i>`
	120
	121	out := ParseDescription("http://localhost", d)
	122	for _, bad := range []string{"<script>", `class="z"`, "<i>"} {
	123	if strings.Contains(out, bad) {
	124	t.Errorf("output contains %q:\n%s", bad, out)
	125	}
	126	}
	127	for _, want := range []string{"<b>b</b>", "<i>"} {
	128	if !strings.Contains(out, want) {
	129	t.Errorf("output lacks %q:\n%s", want, out)
	130	}
	131	}
	132	}
	133
	134	// TestErrorPageShowsOneEscapedLine covers the 502 page: a WAF block arrives
	135	// as a whole HTML document, and only its first line is echoed, as text.
	136	func TestErrorPageShowsOneEscapedLine(t *testing.T) {
	137	rec := httptest.NewRecorder()
	138	skunkyart{Writer: rec, Host: "http://localhost"}.Error(devianter.Error{Error: "blocked <!DOCTYPE html>\n<html>second line"})
	139
	140	body := rec.Body.String()
	141	if rec.Code != 502 {
	142	t.Errorf("status %d, want 502", rec.Code)
	143	}
	144	if strings.Contains(body, "second line") {
	145	t.Errorf("error page carries lines past the first:\n%s", body)
	146	}
	147	if strings.Contains(body, "<!DOCTYPE html>") \|\| !strings.Contains(body, "<!DOCTYPE html>") {
	148	t.Errorf("upstream error not escaped:\n%s", body)
	149	}
	150	}

app/parsers.go +43 −31

 		cmmts.WriteString(`"><p id="`)
 		cmmts.WriteString(strconv.Itoa(x.ID))
 		cmmts.WriteString(`"><img src="`)
-		cmmts.WriteString(URLBuilder(s.Host, "media", "emojitar", x.User.Username, "?type=a"))
+		cmmts.WriteString(esc(URLBuilder(s.Host, "media", "emojitar", x.User.Username, "?type=a")))
 		cmmts.WriteString(`" width="30px" height="30px"><a href="`)
-		cmmts.WriteString(URLBuilder(s.Host, "group_user", "?q=", x.User.Username, "&type=a"))
+		cmmts.WriteString(esc(URLBuilder(s.Host, "group_user", "?q=", x.User.Username, "&type=a")))
 		cmmts.WriteString(`"><b`)
 		cmmts.WriteString(` class="`)
 		if x.User.Banned {
 			cmmts.WriteString(`author`)
 		}
 		cmmts.WriteString(`">`)
-		cmmts.WriteString(x.User.Username)
+		cmmts.WriteString(esc(x.User.Username))
 		cmmts.WriteString("</b></a> ")
 		if x.Parent > 0 {
 			cmmts.WriteString(` In reply to <a href="`)
-			cmmts.WriteString(s._pth)
+			cmmts.WriteString(esc(s._pth))
 			cmmts.WriteString("#")
 			cmmts.WriteString(strconv.Itoa(x.Parent))
 			cmmts.WriteString(`">`)
 			if replied[x.Parent] == "" {
 				cmmts.WriteString("???")
 			} else {
-				cmmts.WriteString(replied[x.Parent])
+				cmmts.WriteString(esc(replied[x.Parent]))
 			}
 			cmmts.WriteString("</a>")
 		}
 		if !VisibleDeviation(data) {
 			continue
 		}
-		if preview, fullview := ParseMedia(s.Host, data.Media, 320), ParseMedia(s.Host, data.Media); true {
+		// Escaped once here: the same values go into both the HTML grid and the
+		// Atom feed, and html.EscapeString produces entities XML accepts too.
+		author, title := esc(data.Author.Username), esc(data.Title)
+		postURL := esc(ConvertDeviantArtURLToSkunkyArt(s.Host, data.Url))
+		if preview, fullview := esc(ParseMedia(s.Host, data.Media, 320)), esc(ParseMedia(s.Host, data.Media)); true {
 			if allowAtom && s.Atom {
 				s.Writer.Header().Add("Content-Type", "application/atom+xml")
 				id := strconv.Itoa(data.ID)
 				listContent.WriteString(`<entry><author><name>`)
-				listContent.WriteString(data.Author.Username)
+				listContent.WriteString(author)
 				listContent.WriteString(`</name></author><title>`)
-				listContent.WriteString(data.Title)
+				listContent.WriteString(title)
 				listContent.WriteString(`</title><link rel="alternate" type="text/html" href="`)
-				listContent.WriteString(URLBuilder(s.Host, "post", data.Author.Username, "atom-"+id))
+				listContent.WriteString(esc(URLBuilder(s.Host, "post", data.Author.Username, "atom-"+id)))
 				listContent.WriteString(`"/><id>`)
 				listContent.WriteString(id)
 				listContent.WriteString(`</id><published>`)
 				listContent.WriteString(data.PublishedTime.UTC().Format("Mon, 02 Jan 2006 15:04:05 -0700"))
 				listContent.WriteString(`</published>`)
 				listContent.WriteString(`<media:group><media:title>`)
-				listContent.WriteString(data.Title)
+				listContent.WriteString(title)
 				listContent.WriteString(`</media:title><media:thumbinal url="`)
 				listContent.WriteString(preview)
 				listContent.WriteString(`"/></media:group><content type="xhtml"><div xmlns="http://www.w3.org/1999/xhtml"><a href="`)
-				listContent.WriteString(ConvertDeviantArtURLToSkunkyArt(s.Host, data.Url))
+				listContent.WriteString(postURL)
 				listContent.WriteString(`"><img src="`)
 				listContent.WriteString(fullview)
 				listContent.WriteString(`"/></a><p>`)
 					listContent.WriteString(`<h1>[ TEXT ]</h1>`)
 				}
 				listContent.WriteString(`<br><a href="`)
-				listContent.WriteString(ConvertDeviantArtURLToSkunkyArt(s.Host, data.Url))
+				listContent.WriteString(postURL)
 				listContent.WriteString(`">`)
-				listContent.WriteString(data.Author.Username)
+				listContent.WriteString(author)
 				listContent.WriteString(" - ")
-				listContent.WriteString(data.Title)
+				listContent.WriteString(title)
 				if data.NSFW {
 					listContent.WriteString(` [<span class="nsfw">NSFW</span>]`)
 		case s.Type == 0:
 			list.WriteString("Daily Deviations")
 		case s.Type == 'g' && len(devs) != 0:
-			list.WriteString(devs[0].Author.Username)
+			list.WriteString(esc(devs[0].Author.Username))
 		default:
 			list.WriteString("SkunkyArt")
 		}
 		list.WriteString(`</title>`)
 		list.WriteString(`<link rel="alternate" href="`)
-		list.WriteString(s.Host)
+		list.WriteString(esc(s.Host))
 		list.WriteString(`"/>`)
 		list.WriteString(listContent.String())
 				for n := range Styles {
 					Styles := &Styles[n]
 					Styles.TxtRaw = x.Text[Styles.From:Styles.To]
-					Styles.Txt = TagBuilder(Styles.TxtRaw, tags[Styles.From*Styles.To]...)
+					Styles.Txt = TagBuilder(esc(Styles.TxtRaw), tags[Styles.From*Styles.To]...)
 				}
 			}
 				if len(x.EntityRanges) != 0 {
 					d := entities[x.EntityRanges[0].Key]
 					parsedDescription.WriteString(`<a href="`)
-					parsedDescription.WriteString(ConvertDeviantArtURLToSkunkyArt(host, d.Url))
+					parsedDescription.WriteString(esc(ConvertDeviantArtURLToSkunkyArt(host, d.Url)))
 					parsedDescription.WriteString(`"><img width="50%" src="`)
-					parsedDescription.WriteString(ParseMedia(host, d.Media))
+					parsedDescription.WriteString(esc(ParseMedia(host, d.Media)))
 					parsedDescription.WriteString(`" title="`)
-					parsedDescription.WriteString(d.Author.Username)
+					parsedDescription.WriteString(esc(d.Author.Username))
 					parsedDescription.WriteString(" - ")
-					parsedDescription.WriteString(d.Title)
+					parsedDescription.WriteString(esc(d.Title))
 					parsedDescription.WriteString(`"></a>`)
 				}
 			case "unstyled":
 							tag = "h2"
 						}
-						parsedDescription.WriteString(x.Text[:r.From])
+						parsedDescription.WriteString(esc(x.Text[:r.From]))
 						if len(urls) != 0 && len(x.EntityRanges) != 0 {
 							ra := &x.EntityRanges[0]
 							parsedDescription.WriteString(`<a target="_blank" href="`)
-							parsedDescription.WriteString(urls[ra.Key])
+							parsedDescription.WriteString(esc(urls[ra.Key]))
 							parsedDescription.WriteString(`">`)
 							parsedDescription.WriteString(r.Txt)
 							parsedDescription.WriteString(`</a>`)
 						} else if l > n+1 {
 							parsedDescription.WriteString(r.Txt)
 						}
-						parsedDescription.WriteString(TagBuilder(tag, x.Text[r.To:]))
+						parsedDescription.WriteString(TagBuilder(tag, esc(x.Text[r.To:])))
 					}
 				} else {
-					parsedDescription.WriteString(x.Text)
+					parsedDescription.WriteString(esc(x.Text))
 				}
 			}
 			parsedDescription.WriteString("<br>")
 						if a.Key == "href" {
 							url := DeleteTrackingFromURL(a.Val)
 							parsedDescription.WriteString(`<a target="_blank" href="`)
-							parsedDescription.WriteString(url)
+							parsedDescription.WriteString(esc(url))
 							parsedDescription.WriteString(`">`)
-							parsedDescription.WriteString(GetValueOfTag(tt))
+							parsedDescription.WriteString(esc(GetValueOfTag(tt)))
 							parsedDescription.WriteString("</a> ")
 						}
 					}
 						if title != "" {
 							for x := -1; x < b; x++ {
 								parsedDescription.WriteString(`<img src="`)
-								parsedDescription.WriteString(uri)
+								parsedDescription.WriteString(esc(uri))
 								parsedDescription.WriteString(`" title="`)
-								parsedDescription.WriteString(title)
+								parsedDescription.WriteString(esc(title))
 								parsedDescription.WriteString(`">`)
 							}
 						}
 					}
 				case "br", "li", "ul", "p", "b":
-					parsedDescription.WriteString(token.String())
+					// The bare tag, not token.String(): that would carry over
+					// whatever attributes DeviantArt's markup put on it.
+					if token.Type == html.EndTagToken {
+						parsedDescription.WriteString("</")
+					} else {
+						parsedDescription.WriteString("<")
+					}
+					parsedDescription.WriteString(token.Data)
+					parsedDescription.WriteString(">")
 				case "div":
 					parsedDescription.WriteString("<p> ")
 				}
 			case html.TextToken:
-				parsedDescription.Write(tt.Text())
+				parsedDescription.WriteString(esc(string(tt.Text())))
 			}
 		}
 	}

app/util.go +40 −23

 	"context"
 	"encoding/json"
 	"fmt"
+	htmlesc "html"
+	"html/template"
 	"io"
 	"net/http"
 	"net/url"
 	"skunkyart/static"
 	"strconv"
 	"strings"
-	"text/template"
 	"time"
 	"github.com/krazywarez/devianter"
 	}
 }
+// esc escapes s for use as HTML text or inside a quoted attribute. The Go-built
+// fragments bypass html/template's contextual escaping because they are handed
+// to it as template.HTML, so every DeviantArt-supplied string they contain has
+// to be escaped here instead.
+func esc(s string) string {
+	return htmlesc.EscapeString(s)
+}
 // restore swallows a panic in the calling goroutine so that one bad parse cannot
 // take the whole process down. The panic is logged rather than dropped silently.
 func restore() {
 	API     API
 	Version string
+	// The template.HTML fields hold fragments the Go builders already
+	// escaped, so html/template inserts them as-is. Everything typed string is
+	// escaped by the template at the point of use.
 	Templates struct {
 		About instanceAbout
-		SomeList  string
+		SomeList  template.HTML
-		DDStrips  string
+		DDStrips  template.HTML
 		Deviation struct {
-			Post       devianter.Post
+			Post        devianter.Post
-			Related    string
+			Description template.HTML
-			StringTime string
+			Related     template.HTML
-			Tags       string
+			StringTime  string
-			Comments   string
+			Tags        template.HTML
+			Comments    template.HTML
 		}
 		GroupUser struct {
 			GR           devianter.GRuser
-			Admins       string
+			Admins       template.HTML
 			Group        bool
 			CreationDate string
 			About struct {
 				A devianter.About
-				DescriptionFormatted string
+				DescriptionFormatted template.HTML
-				Interests, Social    string
+				Interests, Social    template.HTML
-				Comments             string
+				Comments             template.HTML
 				BG                   string
 				BGMeta               devianter.Deviation
 			}
 			Gallery struct {
-				Folders string
+				Folders template.HTML
 				Pages   int
-				List    string
+				List    template.HTML
 			}
 		}
 		Search struct {
 			Content devianter.Search
-			List    string
+			List    template.HTML
 		}
 	}
 }
 	return str.String()
 }
-// Error responds 502 with the error DeviantArt reported upstream.
+// Error responds 502 with the error DeviantArt reported upstream. Only the
+// first line is shown: a WAF block arrives as a whole HTML page, which is
+// neither readable nor safe to echo.
 func (s skunkyart) Error(dAerr devianter.Error) {
 	s.Writer.WriteHeader(502)
+	reason, _, _ := strings.Cut(dAerr.Error, "\n")
 	var msg strings.Builder
 	msg.WriteString(`<html><link rel="stylesheet" href="`)
 	msg.WriteString(URLBuilder(s.Host, "stylesheet"))
 	msg.WriteString(`" /><h3>DeviantArt error — '`)
-	msg.WriteString(dAerr.Error)
+	msg.WriteString(esc(reason))
 	msg.WriteString("'</h3></html>")
 	wr(s.Writer, msg.String())
 func BuildUserPlate(host, name string) string {
 	var htm strings.Builder
 	htm.WriteString(`<div class="user-plate"><img src="`)
-	htm.WriteString(URLBuilder(host, "media", "emojitar", name, "?type=a"))
+	htm.WriteString(esc(URLBuilder(host, "media", "emojitar", name, "?type=a")))
 	htm.WriteString(`"><a href="`)
-	htm.WriteString(URLBuilder(host, "group_user", "?type=about&q=", name))
+	htm.WriteString(esc(URLBuilder(host, "group_user", "?type=about&q=", name)))
 	htm.WriteString(`">`)
-	htm.WriteString(name)
+	htm.WriteString(esc(name))
 	htm.WriteString(`</a></div>`)
 	return htm.String()
 }
 	prevrev := func(msg string, page int, onpage bool) {
 		if !onpage {
 			list.WriteString(`<a href="`)
-			list.WriteString(s._pth)
+			list.WriteString(esc(s._pth))
 			list.WriteString(`?p=`)
 			list.WriteString(strconv.Itoa(page))
 			if s.Type != 0 {
 			}
 			if s.Query != "" {
 				list.WriteString("&q=")
-				list.WriteString(s.Query)
+				list.WriteString(esc(s.Query))
 			}
 			if f := s.Args.Get("folder"); f != "" {
 				list.WriteString("&folder=")
-				list.WriteString(f)
+				list.WriteString(esc(f))
 			}
 			list.WriteString(`">`)
 			list.WriteString(msg)

app/wrapper.go +43 −40

 package app
 import (
+	"html/template"
 	"regexp"
 	"strconv"
 	"strings"
 					var about = &x.ModuleData.GroupAbout
 					group.Group = true
 					group.CreationDate = x.ModuleData.GroupAbout.FoundatedAt.UTC().String()
-					group.About.DescriptionFormatted = ParseDescription(s.Host, about.Description)
+					group.About.DescriptionFormatted = template.HTML(ParseDescription(s.Host, about.Description)) //nolint:gosec // G203: ParseDescription escapes its input
 				} else if false {
 					group.About.A = x.ModuleData.About
 					var about = &group.About.A
 					group.CreationDate = time.Unix(time.Now().Unix()-x.ModuleData.About.RegDate, 0).UTC().String()
-					group.About.DescriptionFormatted = ParseDescription(s.Host, about.Description)
+					group.About.DescriptionFormatted = template.HTML(ParseDescription(s.Host, about.Description)) //nolint:gosec // G203: ParseDescription escapes its input
 					for _, val := range x.ModuleData.About.SocialLinks {
 						var social strings.Builder
 						social.WriteString(`<a target="_blank" href="`)
-						social.WriteString(val.Value)
+						social.WriteString(esc(val.Value))
 						social.WriteString(`">`)
-						social.WriteString(val.Value)
+						social.WriteString(esc(val.Value))
 						social.WriteString("</a><br>")
-						group.About.Social += social.String()
+						group.About.Social += template.HTML(social.String()) //nolint:gosec // G203: escaped above
 					}
 					for _, val := range x.ModuleData.About.Interests {
 						var interest strings.Builder
-						interest.WriteString(val.Label)
+						interest.WriteString(esc(val.Label))
 						interest.WriteString(": <b>")
-						interest.WriteString(val.Value)
+						interest.WriteString(esc(val.Value))
 						interest.WriteString("</b><br>")
-						group.About.Interests += interest.String()
+						group.About.Interests += template.HTML(interest.String()) //nolint:gosec // G203: escaped above
 					}
 				}
-				group.About.Comments = s.ParseComments(devianter.GetComments(strconv.Itoa(group.GR.Gruser.ID), "", s.Page, 4))
+				group.About.Comments = template.HTML(s.ParseComments(devianter.GetComments(strconv.Itoa(group.GR.Gruser.ID), "", s.Page, 4))) //nolint:gosec // G203: ParseComments escapes its input
 			case "cover_deviation":
 				group.About.BGMeta = x.ModuleData.CoverDeviation.Deviation
 				for _, z := range x.ModuleData.GroupAdmins.Results {
 					htm.WriteString(BuildUserPlate(s.Host, z.User.Username))
 				}
-				group.Admins += htm.String()
+				group.Admins += template.HTML(htm.String()) //nolint:gosec // G203: BuildUserPlate escapes its input
 			}
 		}
 		}
 		if folderid > 0 || (s.Type == 'f' && all) {
-			group.Gallery.List = s.DeviationList(content.Content.Results, true, DeviationList{
+			group.Gallery.List = template.HTML(s.DeviationList(content.Content.Results, true, DeviationList{ //nolint:gosec // G203: DeviationList escapes its input
 				More: content.Content.HasMore,
-			})
+			}))
 		} else {
 			for _, x := range content.Content.Gruser.Page.Modules {
 				if len(x.ModuleData.Folders.Results) != 0 {
 							if !x.Thumb.NSFW || CFG.Nsfw {
 								folders.WriteString(`<a href="`)
-								folders.WriteString(ConvertDeviantArtURLToSkunkyArt(s.Host, x.Thumb.Url))
+								folders.WriteString(esc(ConvertDeviantArtURLToSkunkyArt(s.Host, x.Thumb.Url)))
 								folders.WriteString(`"><img loading="lazy" src="`)
-								folders.WriteString(ParseMedia(s.Host, x.Thumb.Media))
+								folders.WriteString(esc(ParseMedia(s.Host, x.Thumb.Media)))
 								folders.WriteString(`" title="`)
-								folders.WriteString(x.Thumb.Title)
+								folders.WriteString(esc(x.Thumb.Title))
 								folders.WriteString(`"></a>`)
 							} else {
 								folders.WriteString(`<h1>[ <span class="nsfw">NSFW</span> ]</h1>`)
 							folders.WriteString(`<a href="group_user?folder=`)
 							folders.WriteString(strconv.Itoa(x.FolderId))
 							folders.WriteString("&q=")
-							folders.WriteString(s.Query)
+							folders.WriteString(esc(s.Query))
 							folders.WriteString("&type=")
 							folders.WriteRune(s.Type)
 							folders.WriteString(`">`)
-							folders.WriteString(x.Name)
+							folders.WriteString(esc(x.Name))
 							folders.WriteString(`</a>`)
 							folders.WriteString("</div>")
 						}
 					}
 					folders.WriteString(`</div><h1 id="content"><a href="#content">#</a> Content</h1>`)
-					group.Gallery.Folders = folders.String()
+					group.Gallery.Folders = template.HTML(folders.String()) //nolint:gosec // G203: escaped above
 				}
 				if x.Name == "folder_deviations" {
-					group.Gallery.List = s.DeviationList(x.ModuleData.Folder.Deviations, true, DeviationList{
+					group.Gallery.List = template.HTML(s.DeviationList(x.ModuleData.Folder.Deviations, true, DeviationList{ //nolint:gosec // G203: DeviationList escapes its input
 						Pages: x.ModuleData.Folder.Pages,
 						More:  x.ModuleData.Folder.HasMore,
-					})
+					}))
 				}
 			}
 		}
 	}
 	if post.Post.Deviation.TextContent.Excerpt != "" {
-		post.Post.Description = ParseDescription(s.Host, post.Post.Deviation.TextContent)
+		post.Description = template.HTML(ParseDescription(s.Host, post.Post.Deviation.TextContent)) //nolint:gosec // G203: ParseDescription escapes its input
 	} else {
-		post.Post.Description = ParseDescription(s.Host, post.Post.Deviation.Extended.DescriptionText)
+		post.Description = template.HTML(ParseDescription(s.Host, post.Post.Deviation.Extended.DescriptionText)) //nolint:gosec // G203: ParseDescription escapes its input
 	}
 	for _, x := range post.Post.Deviation.Extended.RelatedContent {
 		if len(x.Deviations) != 0 {
-			post.Related += s.DeviationList(x.Deviations, false)
+			post.Related += template.HTML(s.DeviationList(x.Deviations, false)) //nolint:gosec // G203: DeviationList escapes its input
 		}
 	}
 	for _, x := range post.Post.Deviation.Extended.Tags {
 		var tag strings.Builder
 		tag.WriteString(` <a href="`)
-		tag.WriteString(URLBuilder(s.Host, "search", "?q=", x.Name, "&type=tag"))
+		tag.WriteString(esc(URLBuilder(s.Host, "search", "?q=", x.Name, "&type=tag")))
 		tag.WriteString(`">#`)
-		tag.WriteString(x.Name)
+		tag.WriteString(esc(x.Name))
 		tag.WriteString("</a>")
-		post.Tags += tag.String()
+		post.Tags += template.HTML(tag.String()) //nolint:gosec // G203: escaped above
 	}
-	post.Comments = s.ParseComments(devianter.GetComments(id, post.Post.Comments.Cursor, s.Page, 1))
+	post.Comments = template.HTML(s.ParseComments(devianter.GetComments(id, post.Post.Comments.Cursor, s.Page, 1))) //nolint:gosec // G203: ParseComments escapes its input
 	post.StringTime = post.Post.Deviation.PublishedTime.UTC().String()
 	post.Post.IMG = ParseMedia(s.Host, post.Post.Deviation.Media)
 	var strips strings.Builder
 	for _, x := range dd.Strips {
 		strips.WriteString(`<h3 class="`)
-		strips.WriteString(x.Codename)
+		strips.WriteString(esc(x.Codename))
 		strips.WriteString(`"> <a href="#`)
-		strips.WriteString(x.Codename)
+		strips.WriteString(esc(x.Codename))
 		strips.WriteString(`"># </a>`)
-		strips.WriteString(x.Title)
+		strips.WriteString(esc(x.Title))
 		strips.WriteString(`</h3>`)
 		strips.WriteString(s.DeviationList(x.Deviations, false))
 	}
-	s.Templates.DDStrips = strips.String()
+	s.Templates.DDStrips = template.HTML(strips.String()) //nolint:gosec // G203: escaped above
-	s.Templates.SomeList = s.DeviationList(dd.Deviations, true, DeviationList{
+	s.Templates.SomeList = template.HTML(s.DeviationList(dd.Deviations, true, DeviationList{ //nolint:gosec // G203: DeviationList escapes its input
 		Pages: 0,
 		More:  dd.HasMore,
-	})
+	}))
 	if !s.Atom {
 		s.ExecuteTemplate("daily.htm", "html", &s)
 	}
 		}
 		if len(usernames) != 0 {
-			ss.List += `<div class="content plates">`
+			var plates strings.Builder
+			plates.WriteString(`<div class="content plates">`)
 			for x := range len(usernames) {
-				ss.List += BuildUserPlate(s.Host, usernames[x])
+				plates.WriteString(BuildUserPlate(s.Host, usernames[x]))
 			}
-			ss.List += `</div>`
+			plates.WriteString(`</div>`)
-			ss.List += s.NavBase(DeviationList{
+			plates.WriteString(s.NavBase(DeviationList{
 				More: true,
-			})
+			}))
+			ss.List = template.HTML(plates.String()) //nolint:gosec // G203: BuildUserPlate escapes its input
 		}
 	default:
 		s.ReturnHTTPError(400)
 			return
 		}
-		ss.List = s.DeviationList(ss.Content.Results, false, DeviationList{
+		ss.List = template.HTML(s.DeviationList(ss.Content.Results, false, DeviationList{ //nolint:gosec // G203: DeviationList escapes its input
 			Pages: ss.Content.Pages,
 			More:  ss.Content.HasMore,
-		})
+		}))
 	}
 	s.ExecuteTemplate("search.htm", "html", &s)

static/html/deviantion.htm +2 −2

	@@ -22,11 +22,11 @@
22	<span>{{T "deviation.published"}}<strong>{{.Templates.Deviation.StringTime}}</strong>; Views: <strong>{{.Templates.Deviation.Post.Deviation.Stats.Views}}</strong>; Favourites: <strong>{{.Templates.Deviation.Post.Deviation.Stats.Favourites}}</strong>; Downloads: <strong>{{.Templates.Deviation.Post.Deviation.Stats.Downloads}}</strong>	22	<span>{{T "deviation.published"}}<strong>{{.Templates.Deviation.StringTime}}</strong>; Views: <strong>{{.Templates.Deviation.Post.Deviation.Stats.Views}}</strong>; Favourites: <strong>{{.Templates.Deviation.Post.Deviation.Stats.Favourites}}</strong>; Downloads: <strong>{{.Templates.Deviation.Post.Deviation.Stats.Downloads}}</strong>
23	<br><a target="_blank" href="https://www.deviantart.com/{{.Templates.Deviation.Post.Deviation.Author.Username}}/art/art-{{.Templates.Deviation.Post.Deviation.ID}}">{{T "deviation.original"}}</a>	23	<br><a target="_blank" href="https://www.deviantart.com/{{.Templates.Deviation.Post.Deviation.Author.Username}}/art/art-{{.Templates.Deviation.Post.Deviation.ID}}">{{T "deviation.original"}}</a>
24	</span>	24	</span>
25	{{if (ne .Templates.Deviation.Post.Description "")}}	25	{{if (ne .Templates.Deviation.Description "")}}
26	<figcaption>	26	<figcaption>
27	<details>	27	<details>
28	<summary>{{T "deviation.description"}}</summary>	28	<summary>{{T "deviation.description"}}</summary>
29	{{.Templates.Deviation.Post.Description}}	29	{{.Templates.Deviation.Description}}
30	</details>	30	</details>
31	</figcaption>	31	</figcaption>
32	{{end}}	32	{{end}}

Commit 35d16226b9

Commit `35d16226b9`