From 1e1ca8d50bcbf402c38721576df746e1463764b4 Mon Sep 17 00:00:00 2001
From: aram price <aramprice@users.noreply.github.com>
Date: Thu, 6 Aug 2026 18:50:13 +0200
Subject: [PATCH] Potential fix for code scanning alert no. 5: Reflected
 cross-site scripting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 handlers/handler.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/handlers/handler.go b/handlers/handler.go
index 39cc85d..1aeec94 100644
--- a/handlers/handler.go
+++ b/handlers/handler.go
@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 	"path/filepath"
 	"strings"
@@ -116,14 +117,16 @@ func (h *Handler) GetMeta(writer http.ResponseWriter, request *http.Request) {
 	if subdir := h.config.Subdirs[repoName]; subdir != "" {
 		goImportContent = fmt.Sprintf("%s %s", goImportContent, subdir)
 	}
-	goImport := fmt.Sprintf("<meta name=\"go-import\" content=\"%s\">", goImportContent)
+	escapedGoImportContent := html.EscapeString(goImportContent)
+	goImport := fmt.Sprintf("<meta name=\"go-import\" content=\"%s\">", escapedGoImportContent)
 	logger.Debug("meta.go-import", lager.Data{"content": goImportContent})
 	if _, err := fmt.Fprint(writer, goImport); err != nil {
 		logger.Error("meta.go-import", err)
 	}
 
 	goSourceContent := fmt.Sprintf("%s _ %s", h.config.ImportPrefix+"/"+repoName, location)
-	goSource := fmt.Sprintf("<meta name=\"go-source\" content=\"%s\">", goSourceContent)
+	escapedGoSourceContent := html.EscapeString(goSourceContent)
+	goSource := fmt.Sprintf("<meta name=\"go-source\" content=\"%s\">", escapedGoSourceContent)
 	logger.Debug("meta.go-source", lager.Data{"content": goSourceContent})
 	if _, err := fmt.Fprint(writer, goSource); err != nil {
 		logger.Error("meta.go-source", err)