Question

Is there any plugin allowing user to create there own templates? So I use smth like

Templates.find(5).render(:val1 => val1, :val2 => val2)

There is a good plugin named liquid however it doesn’t seem to be safe (user can drop database and so on).

Thank you.

Answer 1

Liquid is a very popular templeting system and is considered safe. In fact it was one of the design goals. From the documentation of liquid:

Liquid is a template engine which was written with very specific requirements:

It has to have beautiful and simple markup. Template engines which don’t produce good looking markup are no fun to use.

It needs to be non evaling and secure. Liquid templates are made so that users can edit them. You don’t want to run code on your server which your users wrote.

It has to be stateless. Compile and render steps have to be seperate so that the expensive parsing and compiling can be done once and later on you can just render it passing in a hash with local variables and objects.