Backport fix for CVE-2024-53257 to release-18.0-github

[danieljoos]

These templates were rendered using text/template which is fundamentally broken as it would allow for trivial HTML injection.

Instead render using safehtml/template so that we have automatic escaping.

---

This is backporting the fix for CVE-2024-53257 to release-18.0-github.

Description

Related Issue(s)

Checklist

• "Backport to:" labels have been added if this change should be back-ported
• Tests were added or are not required
• Documentation was added or is not required

Deployment Notes

[Copilot]

Copilot reviewed 5 out of 6 changed files in this pull request and generated no suggestions.

Files not reviewed (1)

• go/vt/vtgate/debugenv.go: Evaluated as low risk

Comments skipped due to low confidence (3)

go/vt/vttablet/tabletserver/querylogz_test.go:39

• Ensure that the test case covers scenarios where the SQL query contains potentially malicious content to verify that the safehtml/template correctly sanitizes the output.

logStats.OriginalSQL = "select name, 'inject <script>alert();</script>' from test_table limit 1000"

go/vt/vtgate/querylogz.go:25

• Ensure that all templates previously rendered with text/template are now rendered with safehtml/template to prevent HTML injection vulnerabilities.

+	"github.com/google/safehtml/template"

go/vt/vttablet/tabletserver/querylogz.go:25

• [nitpick] Ensure that the import alias for the safehtml/template package is consistent across the codebase for clarity.

"github.com/google/safehtml/template"

Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more