Server Side Template Injection in Fiber with Api Keys

Server Side Template Injection (SSTI) in Fiber becomes high risk when API keys are handled through template-rendering paths. In Go templates, unsafe use of .Title or .Description derived from user input can allow an attacker to inject template actions. When an API key is passed into a template context—such as logging, error pages, or dynamic configuration displays—the attacker may leverage Go template functions to read environment variables or make network calls.

For example, if a Fiber route renders a debug HTML page using a struct that embeds the API key string, an SSTI payload can traverse the object graph. A payload like {{ .APIKey | printf "test%s" | print }} may not directly execute code, but combined with other template capabilities it can reach sensitive data. More dangerous are expressions that invoke functions registered in the template’s function map, which can occur if the application adds helpers that interact with filesystem or HTTP clients.

Consider a scenario where the API key is stored in a map and passed to the template as data["apiKey"]. An attacker who can control the key name via a parameter may attempt {{ index . "apiKey" }} to confirm injection, then escalate to {{ urlquery .Env }}-style traversal if the template function map includes helpers that expose environment variables. In real-world exposures, this can lead to disclosure of secrets used for authentication, which compounds the impact because API keys often grant access to downstream services.

The risk is amplified when API keys are used to authorize requests and the same template context also reflects user-controlled data. An attacker can probe for template injection via crafted query parameters or header values that flow into error messages or dynamic views. Because SSTI can chain with other weaknesses—such as missing input validation or overly permissive function maps—the exposure of API keys through templates should be treated as a critical finding in scans, mapping to OWASP API Top 10 A01:2023 Broken Object Level Authorization and A05:2023 Injection.

middleBrick detects this pattern by correlating OpenAPI spec definitions that expose API key locations (e.g., in headers or cookies) with runtime template-rendering endpoints. The scanner checks whether user-controlled data reaches template evaluation points and flags routes where API key structures are dynamically rendered. This helps teams identify dangerous combinations before an attacker chains SSTI with key exfiltration.

Remediation focuses on two areas: preventing untrusted data from entering template contexts, and ensuring API keys are never exposed to the template engine. The safest approach is to avoid rendering API keys in HTML or dynamic templates entirely. If keys must be shown for debugging, they should be redacted or masked and handled outside the template layer.

Use explicit context separation: pass only necessary, sanitized data to templates. For example, instead of passing the full API key struct, pass a masked representation:

type SafeDebug struct {
    APIKeyMasked string
}

// In your route
key := os.Getenv("SERVICE_API_KEY")
// Mask all but last 4 characters
masked := "****-****-****-" + key[len(key)-4:]
c.Render(200, fiber.Map{
    "debug": SafeDebug{APIKeyMasked: masked},
})

If you must keep API keys out of templates, validate and restrict the function map. Do not register filesystem or HTTP helpers unless absolutely necessary, and avoid using template.FuncMap that can evaluate arbitrary expressions on user-controlled data:

funcMap := template.FuncMap{
    "safeUpper": strings.ToUpper,
    // Do NOT add exec, system, or file helpers
}
tmpl := template.New("page").Funcs(funcMap)

For API key handling in requests, prefer standard security mechanisms such as Authorization headers with Bearer tokens, and validate keys on the server without reflecting them into views. When using environment variables, load them once at startup and keep them out of request-time template evaluation:

apiKey := os.Getenv("API_KEY")
// Use apiKey for outbound service authentication
// Do NOT assign it to a struct field used in template rendering

When integrating middleBrick into your workflow, the CLI can be run from the terminal to detect risky patterns: middlebrick scan <url>. Teams using the Pro plan gain continuous monitoring, so changes to template rendering or API key exposure trigger alerts. The GitHub Action can enforce a maximum risk score in CI/CD, failing builds if new endpoints introduce SSTI-prone template usage with sensitive data.