go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.

Fixed

github.com/l3montree-dev/devguard/cmd/devguard-scanner/sast

/builds/open-code/badgebackend/badge-api/pkg/api/handler/repository_handler.go

T
Tim Bastin detected go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
main
T
Tim Bastin fixed go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
main
T
Tim Bastin detected go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
main
T
Tim Bastin fixed go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
main
T
Tim Bastin detected go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
main
T
Tim Bastin fixed go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
main
T
Tim Bastin detected go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
main
T
Tim Bastin fixed go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
main

/Badge API Programm ZenDiS
Group
/Badge API
Repository

go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter

Reopen this vulnerability

Rule Details