Buffalo APIs become vulnerable to XSS when developers bypass the standard JSON renderer to return raw data or manually constructed strings without proper Content-Type enforcement. If an attacker can inject a script tag into a response that a browser sniffs as HTML, you've got a reflected XSS primitive. As a researcher, I look for instances where `r.Data` or `r.String` is used with unsanitized user input.

The Vulnerable Pattern

func (v Resource) Show(c buffalo.Context) error {
	// Vulnerable: Reflecting raw input using r.Data with potentially dangerous MIME types
	userInput := c.Param("id")
	return c.Render(200, r.Data("text/html", []byte("
User Profile
ID: " + userInput + "
")))
}

The Secure Implementation

The exploit vector relies on the browser interpreting the API response as HTML. In the vulnerable example, using `r.Data` with `text/html` allows the `id` parameter to execute arbitrary JavaScript if it contains `