Safe ERB Language?

Question

I wonder if there is a safe template that reassemble ERB. ERB is very easy to use, but the deadly part to use that in a CMS is the over powerful access (you can just write some really nasty stuff with that in a matter of seconds...) So I wonder if there is any chance such language exist.

Please I don't want radius/liquid..... writing extension for that is too much trouble and the template syntax itself is just not my cup of tea... I would want to avoid it if ever possible.

Update: This is not perfect (as its not erb) but seems way much better than Liquid: http://github.com/scottpersinger/laminate

You have to use Lua for your template, but Lua is already a lot better than trying to use liquid (which disable you from doing a simple assignment syntax...)

You're letting your end users enter the template language code itself? I'm not sure what you're trying to accomplish here. — jdl, Nov 11 '09 at 16:24
A hosted CMS which allow designers with some HTML knowledge to create their own template without doing a rm -rf . in your file system. — William Yeung, Nov 11 '09 at 17:42
Yes- I am letting end users (the web master) to entire their own template, thats the whole point why a library like LiquidMarkup exist. Unfortunately liquid markup is a very terrible language to write- most people given up php smarty style template engine, and Liquid actually reassemble that. — William Yeung, Nov 11 '09 at 17:45
What do you have against liquid? What are you trying to extend it to do? — Ryan Bigg, Nov 11 '09 at 20:45
@goodwill: whether laminate is better or worse may be a moot point -- it doesn't look to be maintained in 3 years. — David J., Jun 06 '12 at 16:56

David J. · Answer 1 · 2012-06-06T16:50:37.327

3

You should consider Handlebars.rb. It "uses therubyracer to bind to the actual JavaScript implementation of Handlebars.js so that you can use it from ruby."

Here is their example code:

require 'handlebars'
handlebars = Handlebars::Context.new
template = handlebars.compile("{{say}}{{what}}")
template.call(:say => "Hey", :what => "Yuh!") #=> "Hey Yuh!"

edited Jun 06 '12 at 16:50

answered Jun 06 '12 at 16:45

David J.

31,569
22
122
174

I don't share goodwill's dislike of Liquid, but what makes Handlebars.rb attractive to me is that I can use the same template language (and potential the same templates) both server- and client-side. – Jimothy Jun 30 '13 at 04:03

score 2 · Answer 2 · answered Jun 06 '12 at 16:48

Although you wrote "Please I don't want radius/liquid", I don't understand your reluctance. Just go to the Liquid page and see how easy it is:

gem install liquid

Here is an example snippet:

<ul id="products">
  {% for product in products %}
    <li>
      <h2>{{ product.title }}</h2>
      Only {{ product.price | format_as_money }}

      <p>{{ product.description | prettyprint | truncate: 200  }}</p>
    </li>
  {% endfor %}
</ul>

And, to use it:

Liquid::Template.parse(template).render 'products' => Product.find(:all)

Does that allow `{% product.destroy %}` or something like `{{ product.connection.password }}`? — Kimmo Lehto, May 29 '18 at 11:31

score 2 · Answer 3 · answered Jun 06 '12 at 18:56

2

You should also consider Mustache:

Mustache.render("Hello {{planet}}", :planet => "World!")
=> "Hello World!"

answered Jun 06 '12 at 18:56

David J.

31,569
22
122
174

Safe ERB Language?

3 Answers3

Linked