Server Side Template Injection in Gin with Cockroachdb

Server Side Template Injection (SSTI) in the Gin framework becomes particularly concerning when query results from CockroachDB are passed into templates without adequate escaping. Gin uses the html/template package by default, which provides auto-escaping for HTML, JavaScript, and CSS contexts. However, if a developer uses the deprecated {{.}} syntax with template.HTML or passes raw database strings directly into template actions, the escaping layer can be bypassed.

When an API endpoint queries CockroachDB using a user-controlled parameter such as an organization ID, the returned data may be used to render dynamic content. For example, a handler might retrieve a user-supplied label from a CockroachDB row and embed it into a template like this:

tmpl, _ := template.New("page").Parse("Welcome " + template.HTML(name) + "!")
tmpl.Execute(w, nil)

If name originates from a CockroachDB query like SELECT display_name FROM users WHERE org_id = $1 and is injected into the template as template.HTML, an attacker can supply a payload such as <script>stealCookies()</script>. Because the content is marked as safe HTML, Gin does not escape it, leading to stored or reflected XSS. SSTI can also manifest when template functions are abused; for instance, calling unsafe functions like print or printf on user data allows execution of arbitrary template code, which in turn can be chained to access Go internals or perform filesystem operations.

The risk is amplified when API metadata or error messages from CockroachDB are reflected in templates. An attacker can probe for database structure by injecting template syntax such as {{ index . "0" }} or {{ .Values }} to enumerate context variables. middleBrick scans detect such patterns by correlating OpenAPI inputs with template rendering behavior, identifying places where database-driven content reaches the presentation layer without proper sanitization.

Compliance mappings are relevant here: OWASP API Top 10 A03:2023 Injection and A05:2023 Security Misconfiguration both apply, as do PCI-DSS requirements around input validation. middleBrick’s LLM/AI Security checks further identify whether error messages or debug endpoints might aid template injection attempts, ensuring that even indirect paths are evaluated.

Remediation centers on strict separation of data and presentation, combined with context-aware escaping. Always treat data from CockroachDB as untrusted. Use Go’s html/template package correctly by avoiding template.HTML unless absolutely necessary, and never concatenate strings to build templates dynamically.

Prefer parameterized queries to prevent SQL injection, and ensure that values retrieved from CockroachDB are not re-introduced into templates as safe HTML. The following example demonstrates a secure handler pattern:

import (
    "database/sql"
    "net/http"
    "text/template"

    _ "github.com/lib/pq"
)

type PageData struct {
    DisplayName string
}

func handler(w http.ResponseWriter, r *http.Request) {
    orgID := r.URL.Query().Get("org_id")
    var displayName string
    err := db.QueryRow(r.Context(), "SELECT display_name FROM users WHERE org_id = $1", orgID).Scan(&displayName)
    if err != nil {
        http.Error(w, "User not found", http.StatusNotFound)
        return
    }

    tmpl, err := template.New("page").Parse("Welcome {{ .DisplayName }}!")
    if err != nil {
        http.Error(w, "Internal error", http.StatusInternalServerError)
        return
    }
    data := PageData{DisplayName: displayName}
    tmpl.Execute(w, data)
}

In this example, displayName is passed as a plain string to the template. The {{ .DisplayName }} action is automatically escaped for HTML context by html/template, neutralizing any injected script content. Note the use of $1 placeholder in the CockroachDB query, which ensures that the parameter is handled safely by the driver, preventing both SQL injection and accidental template interpolation.

For APIs that must render rich content, define strict allowlists and use dedicated sanitization libraries before marking content as safe. Avoid functions like printf inside templates when dealing with user data:

{{ /* Unsafe — do not do this */ }}
{{ printf "<div>%s</div>" .UserContent }}

{{ /* Safe alternative */ }}
<div>{{ .UserContent }}</div>

middleBrick’s GitHub Action can be integrated into CI/CD to flag templates that use template.HTML with database values, while the MCP server enables on-the-fly scanning during development. The CLI tool supports automated scans of your API endpoints, ensuring that any regression introducing unsafe template usage is caught before deployment.