txscript: switch template engine from html/template to text/template
What the developer wrote
Authored by Erick Cestari
txscript: switch template engine from html/template to text/template
html/template automatically HTML-escapes special characters to prevent
XSS, which can silently corrupt arbitrary script data. Since the output
is binary script bytes and not HTML, this escaping provides no benefit
and might breaks correctness.
What changed, and why it matters
This commit swaps the template engine used to build Bitcoin scripts from Go's HTML-aware template package to a plain-text template package. The old engine would automatically escape characters like angle brackets and quotes for safe web display, but because the output here is raw binary script data, that escaping could quietly change the bytes produced. The fix removes a source of silent data corruption when users generate transaction scripts from templates.
Treat this as a correctness fix rather than an active exploit. Users who generated scripts via templates should review whether previously produced scripts were affected by HTML-style escaping, especially if templates contained characters such as `<`, `>`, `&`, or quotes. Consider adding tests that exercise templates with such characters to ensure script bytes match expectations.
Security signals we found
Silent data corruption in generated Bitcoin scripts
Template auto-escaping applied to non-HTML binary output
Potential script malleability or invalid-script risk
No input validation changes or bounds checks added
Evidence from the diff
The change in txscript/template.go replaces html/template with text/template. html/template applies contextual auto-escaping (HTML entities, URL escaping, JS/CSS escaping depending on context) to template output. Because processScript parses the rendered template string and converts it to script opcodes/pushdata, any auto-escaping introduced by html/template would alter the intended script bytes. text/template performs no such escaping, so the rendered string reflects the template and data values verbatim. The diff is a one-line import swap plus a whitespace cleanup.
Changed components
btcd/txscript/template.goScriptTemplate rendering pipelineprocessScript template-to-script conversionInspect captured patch +1 / −2
diff --git a/txscript/template.go b/txscript/template.go
index cc30796..357a105 100644
--- a/txscript/template.go
+++ b/txscript/template.go
@@ -5,9 +5,9 @@ import (
"bytes"
"encoding/hex"
"fmt"
- "html/template"
"strconv"
"strings"
+ "text/template"
)
// ScriptTemplateOpt is a function type for configuring the script template.
@@ -103,7 +103,6 @@ func looksLikeInt(s string) bool {
return len(s) > 0
}
-
// processScript converts the template output to actual script bytes. We scan
// each line, then go through each element one by one, deciding to either add a
// normal op code, a push data, or an integer value.
Why this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.