eatjason
Generating HTML from strings rather than templates
Fairly new to elixir and phoenix, but am really enjoying how it all fits together. I have a question about templates, is there a way to run a render function from a string rather than a file? Say I have a string that includes <%= function_call() %> and have it generate the html that I can send to another render function that uses a template?
Obviously this would have security issues, because I would be taking strings from a database that I entered into an admin input, and if someone got access they could do a <%= destroy_database() %> like command. So a second question is can I limit the modules that can be called from a template? Then the template would only be able to run functions I have supplied.
So two questions, can I limit modules to a template, and can I generate code from a string from a database rather than a template, and also limit modules to that string?
If not I think it would be a nice feature if security issues are sorted out.
First Post!
kokolegorille
Most Liked
benwilson512
All of those operate at compile time on compile time values. If you have code that accepts a user supplied string and evaluates it at runtime, it’s exactly the same as calling Code.eval_string, it’s wildly unsafe.
benwilson512
Making EEX safe is as exactly as impossible as making .exs safe. Here are some past threads on the issue:
benwilson512
No, EEX is not safe to use for user supplied templates. Consider using something like mustache.
Last Post!
benwilson512
~E is not part of the standard library, it’s provided by Phoenix HTML Phoenix.HTML — Phoenix.HTML v4.3.0
Popular in Questions
Other popular topics
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex









