I’m writing an application in Elixir where users should be able to create templates (which later get rendered into HTML and then into PDF). I’m currently working with EEx, however there’s two problems to tackle: code execution (this one I know how to handle, since EEx can compile to a quoted expr…

There is no way to make EEx safe. Instead you should use another template library that will not also be easier for users, but also will be more secure, for example: GitHub - soranoba/bbmustache: Binary pattern match Based Mustache template engine for Erlang/OTP. · GitHub erlydtl | Hex solid | Hex

This would be for an internal tool and the people using it would have experience with Elixir, so the EEx syntax would already be familiar. Honestly the only real problem I’m still facing is the generation of atoms and I’d really like to solve it if possible (without having an entire modified copy of…

There is no way to make any templating safe, not even markdown. However, you can sanitize the resulting html with [ html_sanitize_ex | Hex ] Turned out I did not read the original post carefully. I was thinking about safe to embedding user content on your website and the post was talking about safe t…

With Markdown the “unsafe” part is potential XSS attacks, but in this case the internal tool will just render the HTML in a headless browser (that doesn’t keep any state) to render a PDF. The HTML here is not much of a security concern, but that’s just this specific case :slight_smile:

my experiences with solid have been very good. It has been able to do everything that I want so far, including customizing some of the available template functions. Giving users direct access to eex is probably not the best idea? Solid is a liquid template implementation, which was designed to run …

Elixir Programming Language Forum

"safe" templating in Elixir

Questions & Help Questions

wanton7 July 10, 2021, 5:45pm 5

I’m quite sure markdown is safe if you disable its HTML support.