go-safeweb icon indicating copy to clipboard operation
go-safeweb copied to clipboard

Add a plaintext type that is safe by default

Open empijei opened this issue 4 years ago • 3 comments

It is currently possible to use the default dispatcher to write JSON, templated HTML and static HTML.

It would be beneficial to add one more type to allow text/plain strings to be written.

empijei avatar Feb 08 '21 11:02 empijei

Should this be done using a custom (safehttp/safehtml?) type, or can we just use string or even []byte (providing a similar experience to net/http), as long as we ensure the text/plain content-type header is enforced?

mikue avatar Feb 08 '21 12:02 mikue

A string is IMHO a good choice, especially since we know that they're UTF-8 encoded and we can set the charset properly.

kele avatar Feb 08 '21 12:02 kele

+1 on using strings. If we enforce a safe content-type it should be fine to serve any string.

empijei avatar Feb 15 '21 08:02 empijei