Attacking HTML Templates