BUG: Template execution errors result in corrupt HTML responses #42

New Issue

clawbot · 2026-02-16T06:56:36+01:00

clawbot commented

2026-02-16 06:56:36 +01:00

Severity: MEDIUM

Files: Multiple handlers (setup.go, app.go, auth.go, dashboard.go)

Description

In all handlers, the pattern is:

err := tmpl.ExecuteTemplate(writer, "page.html", data)
if err != nil {
    h.log.Error("template execution failed", "error", err)
    http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
}

The problem: ExecuteTemplate writes directly to the http.ResponseWriter. If the template partially renders before hitting an error, the HTTP 200 status and partial HTML have already been sent. The subsequent http.Error() call:

Cannot change the already-sent 200 status code
Appends "Internal Server Error" text to the partial HTML
Results in a corrupt, half-rendered page

Suggested Fix

Render templates to a buffer first, then write to the response only on success:

var buf bytes.Buffer
err := tmpl.ExecuteTemplate(&buf, "page.html", data)
if err != nil {
    h.log.Error("template execution failed", "error", err)
    http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
    return
}
buf.WriteTo(writer)

This is a common Go web pattern. Consider creating a helper method on Handlers.

## Severity: MEDIUM ## Files: Multiple handlers (setup.go, app.go, auth.go, dashboard.go) ## Description In all handlers, the pattern is: ```go err := tmpl.ExecuteTemplate(writer, "page.html", data) if err != nil { h.log.Error("template execution failed", "error", err) http.Error(writer, "Internal Server Error", http.StatusInternalServerError) } ``` The problem: `ExecuteTemplate` writes directly to the `http.ResponseWriter`. If the template partially renders before hitting an error, the HTTP 200 status and partial HTML have already been sent. The subsequent `http.Error()` call: 1. Cannot change the already-sent 200 status code 2. Appends "Internal Server Error" text to the partial HTML 3. Results in a corrupt, half-rendered page ## Suggested Fix Render templates to a buffer first, then write to the response only on success: ```go var buf bytes.Buffer err := tmpl.ExecuteTemplate(&buf, "page.html", data) if err != nil { h.log.Error("template execution failed", "error", err) http.Error(writer, "Internal Server Error", http.StatusInternalServerError) return } buf.WriteTo(writer) ``` This is a common Go web pattern. Consider creating a helper method on Handlers.

sneak commented

2026-02-16 07:00:48 +01:00

do it, using the helper method. apply it in all places this pattern appears. create a PR.

clawbot referenced a pull request that will close this issue

2026-02-16 07:04:39 +01:00

fix: buffer template execution to prevent corrupt HTML responses (closes #42) #48

sneak closed this issue

2026-02-16 07:05:45 +01:00

sneak referenced this issue from a commit

2026-02-16 07:05:46 +01:00

fix: buffer template execution to prevent corrupt HTML responses (closes #42)

sneak referenced this issue from a commit