On: DOMPurify bypass: XSS via HTML namespace confusion

[vbezhenar]

AFAIK Go template library parses HTML and applies appropriate escaping depending on context. I think that most sane HTML template libraries will do at least HTML escaping by default. Dynamic CSS and JS usually rare so you can pay extra attention.