Fairly new to elixir and phoenix, but am really enjoying how it all fits together. I have a question about templates, is there a way to run a render function from a string rather than a file? Say I have a string that includes <%= function_call() %> and have it generate the html that I can send to …

Hello, there is a special sigil to represent template in Phoenix… Phoenix.HTML — Phoenix.HTML v4.3.0

[image] eatjason: So a second question is can I limit the modules that can be called from a template? Then the template would only be able to run functions I have supplied. No, EEX is not safe to use for user supplied templates. Consider using something like mustache.

All of those operate at compile time on compile time values. If you have code that accepts a user supplied string and evaluates it at runtime, it’s exactly the same as calling Code.eval_string, it’s wildly unsafe.

My bad… I did not read the part concerning security correctly. in particular user facing template.

I would be nice if there was a way to limit an eval_string to only allow certain modules, and just throw exceptions for functions not within that module. Mustache might work… Mainly I wanted to be able to do an image tag like this ~E"“” <img source=“<%= Routes.static_path(”/image.png") =>" /> “…

Making EEX safe is as exactly as impossible as making .exs safe. Here are some past threads on the issue: [image] How to remove/disable BEAM functionalities (creating a sandbox) Questions / Help (archived) Hi, I want to remove unwanted functions from the BEAM…

Adding to this, because I abandoned work on my module-white-listing sandboxing project after related research and feedback from BEAM creators, and am linked in these links: There is no reliable way to prevent arbitrary user-supplied code from invoking functions inside particular modules on the BEAM…

For my use case eval/exs files will be fine, since I will be the only person updating the app. Mustache looks like it will do for outside users. I can’t seem to get the sigil_E function to work, iex claims that it doesn’t even exist in the Kernel. $ mix phx.new --no-webpack --no-ecto test_sigil …

~E is not part of the standard library, it’s provided by Phoenix HTML Phoenix.HTML — Phoenix.HTML v4.3.0

Generating HTML from strings rather than templates

Questions & Help Questions

kokolegorille October 7, 2019, 5:48pm 2

Hello, there is a special sigil to represent template in Phoenix…