Server-Side Template Injection

from flask import Flask, request, render_template

app = Flask(__name__)

@app.route('/greet', methods=['GET'])
def greet():
    user_input = request.args.get('name', 'Guest')
    return render_template('greeting.html', name=user_input)  # Securely passing user input

if __name__ == '__main__':
    app.run(debug=True)

In this secure implementation, user input is passed as a parameter to a predefined template (greeting.html). This prevents direct execution of untrusted input and eliminates the risk of SSTI.

const express = require('express');
const path = require('path');
const app = express();

// Set up Pug as the template engine (Secure if used properly)
app.set('view engine', 'pug');
app.set('views', path.join(__dirname, 'views'));

app.get('/greet', (req, res) => {
    let userInput = req.query.name || 'Guest';
    
    // Render a predefined template with user input safely passed as a variable
    res.render('greeting', { name: userInput });
});

app.listen(3000, () => {
    console.log('Server running on http://localhost:3000');
});

This secure Node.js implementation uses the Pug template engine. User input is never directly injected into the template syntax but is safely passed as a variable to a predefined template (views/greeting.pug). This ensures that input is treated as plain text, mitigating SSTI risks.