web: escape values interpolated into the landing page

[mrueg]

NewLandingPage renders the page with text/template, so nothing it interpolates is escaped. Every field the template reads reaches the browser verbatim — Description, Version, each link's Text, Address and Description, and every form input's Value, Placeholder, Name and Type — including inside the href="…" and value="…" attributes. An exporter that puts a probe target, a query parameter or any other non-constant value on its landing page therefore has an injection point.

Reproduced against master: a Description of </div><script>alert(1)</script> and a link Text of "><script>alert(2)</script> both appear byte-for-byte in the served body.

Change

Render with html/template, which escapes each value for the context it appears in. The two fields documented as carrying markup keep doing so by becoming template.HTML and template.CSS.

The generated stylesheet is still built with text/template: its output is injected into the page as a template.CSS value, and running it through html/template would escape it for an HTML context rather than a CSS one.

Ordinary link addresses are unaffected — /probe?module=http_2xx&target=example.com is written into the attribute as …module=http_2xx&target=example.com, which browsers decode back to a single &. There is a test covering exactly this.

Compatibility

This changes three LandingConfig fields from string to template.HTML/template.CSS. Callers assigning a string literal are unaffected, since an untyped constant converts on assignment; callers assigning a string variable need an explicit conversion.

Tests

landing_page.go had 0% coverage. Added tests for escaping, the two verbatim fields, link query strings, the generated stylesheet, and the handler's 404 path. The escaping test fails against master.

🤖 Generated with Claude Code