5 ms·

Maud: Compile-time HTML templates for Rust

63 points by asib 6y ago

k__ 6y ago
looks like HyperScript-Helpers for Rust, nice!
EE84M3i 6y ago
From the FAQ: >Why doesn't Maud implement context-aware escaping? >If a project follows best practices in separating HTML and CSS/JavaScript, then context-aware escaping is unnecessary. >Google uses context-aware escaping because it has a large, decades-old code base, much of it written before these best practices were well known. Any project that uses Maud is neither large nor decades-old, and so should not have the need for this feature. This seems misguided. Javascript and CSS are not the only contexts. Another example is URIs (which can be javascript: or data:), which Golang's html/template correctly escapes: https://github.com/golang/go/blob/master/src/html/template/url.go#L13 https://github.com/golang/go/blob/master/src/html/template/u...
- stan_rogers 6y ago
  javascript: URIs aren't legit and shouldn't be used. Yes, they work. No, there's no excuse for using them.
  - duckerude 6y ago
    Maybe, but the point of this protection is to avoid accidentally using them. If you let a user supply a URL and they enter a javascript: URI then it'll be defanged.
  - webstrand 6y ago
    There's no real alternative to `javascript:void 0`. If you need to have a link that absolutely will not do anything, even under noscript, it's the only solution. Using `href="#"` is not an alternative, because it messes with the user's navigation history.
    - ximm 6y ago
      Can you give an example on when you would need a link that does not link anywhere? The only cases I can think of are better served by `<button type="button">`.
      - webstrand 6y ago
        I use them for progressive enhancement. If javascript is available, I'll add a dynamically generated href, or call .addEventListener("click", ...) and add behaviour to the link. Buttons can be used sometimes, but if you're wanting something that behaves like a link: middle click works, right click "Open in new Tab", Copy link, etc. then a button doesn't work. I prefer to use buttons to affect the state of the current page. And use anchor tags for all other navigation, even if I'm handling it with .addEventListener("click", ...). I suppose I could just hide the non-functional links, or add them dynamically with javascript. But that could affect layout.
        chrismorgan 6y ago
        If it’s not going to work if JavaScript is unavailable, I would suggest either adding it dynamically with JavaScript, or else omitting the href attribute so that it’s not a link; this could be paired with hiding it, or just giving it attributes like title="JavaScript is required for this link to work" and style="cursor: not-allowed". (Maybe aria-hidden="true" too.)
        webstrand 6y ago
        That's a reasonable option, I'll have to try that. My only concern is that when an anchor tag has no href attribute, the styling is different. It usually behaves as plain text, if I remember correctly, which is really confusing if you expected a link. Nothing that styling can't fix, but that's why, historically, I have always tried provide an href tag, even if it's just href="javascript:void 0". Still, your solution is nicer in many ways, thanks.
        6y ago
- detaro 6y ago
  seems like the FAQ is outdated regarding the authors view on that: https://github.com/lambda-fairy/maud/issues/181 https://github.com/lambda-fairy/maud/issues/181
  - lucideer 6y ago
    I hate to come across as elitist or something—noone's perfect, and I appreciate people building software libraries & releasing them, regardless of their experience as a programmer. But if someone's publishing a HTML templating system, and they don't have enough knowledge about HTML to understand the need for contextual escaping, I would have grave concerns about the Dunning-Kruger effect & the quality of any software that engineer writes.
    - vitno 6y ago
      Dunning-Kruger effect seems like a weird accusation to throw here. The whole basis of it is "a false sense of superiority", but the author is clearly willing to engage on this issue. I think a better way of terming this would be that you have concern the the author might not have enough domain expertise, which is very different than being incompetent. This gives me pause that Maud isn't right for a production system at this time, but is that so surprising for a 0.11 library?
      - lucideer 6y ago
        I suppose one does gain good experience and knowledge if one is receptive to feedback during the developing & maturing of a software project, so that is positive. I guess what I was more getting at was the thought process that goes "I'm going to develop and release a library in X domain", when ones knowledge of said domain is low. And then launching said library before one has really gained a lot of knowledge of that domain.
    - lfairy 6y ago
      I might be biased, as I'm the engineer that you're talking about, but that characterization feels unfair. Context-aware escaping is by no means common in the open source world—just look at Jinja or Handlebars. So unless you're knee-deep in an ecosystem that embraces it, it's easy to brush it off as unimportant.
bajsejohannes 6y ago
Another solution inspired by Mustache is https://github.com/maghoff/bart https://github.com/maghoff/bart
pjmlp 6y ago
> Note that Maud depends on the unstable procedural macro API, and so requires the nightly version of Rust. Oh well.
- Keats 6y ago
  There are many compile-time templates that work on stable: https://github.com/djc/askama https://github.com/djc/askama , https://github.com/maghoff/bart https://github.com/maghoff/bart , https://github.com/kaj/ructe https://github.com/kaj/ructe and https://github.com/Stebalien/horrorshow-rs https://github.com/Stebalien/horrorshow-rs Probably a few others I'm not aware of.
- lfairy 6y ago
  The API in question is stable now, so that will change very soon: https://github.com/lambda-fairy/maud/milestone/1 https://github.com/lambda-fairy/maud/milestone/1
deleted 6y ago
[deleted]
sradman 6y ago
Maud consists of template literals that can be embedded directly in Rust code. It is similar to lit-html and JSX but uses a syntax compatible with Rust rather than using XML style <element attribute=""> syntax. It looks similar to scripting languages like Haml/Pug.
ximm 6y ago
Does someone know of something similar for C?

63 points by asib 6y ago

k__ 6y ago

looks like HyperScript-Helpers for Rust, nice!

From the FAQ: >Why doesn't Maud implement context-aware escaping? >If a project follows best practices in separating HTML and CSS/JavaScript, then context-aware escaping is unnecessary. >Google uses context-aware escaping because it has a large, decades-old code base, much of it written before these best practices were well known. Any project that uses Maud is neither large nor decades-old, and so should not have the need for this feature. This seems misguided. Javascript and CSS are not the only contexts. Another example is URIs (which can be javascript: or data:), which Golang's html/template correctly escapes: https://github.com/golang/go/blob/master/src/html/template/url.go#L13 https://github.com/golang/go/blob/master/src/html/template/u...

stan_rogers 6y ago
javascript: URIs aren't legit and shouldn't be used. Yes, they work. No, there's no excuse for using them.
- duckerude 6y ago
  Maybe, but the point of this protection is to avoid accidentally using them. If you let a user supply a URL and they enter a javascript: URI then it'll be defanged.
- webstrand 6y ago
  There's no real alternative to `javascript:void 0`. If you need to have a link that absolutely will not do anything, even under noscript, it's the only solution. Using `href="#"` is not an alternative, because it messes with the user's navigation history.
  - ximm 6y ago
    Can you give an example on when you would need a link that does not link anywhere? The only cases I can think of are better served by `<button type="button">`.
    - webstrand 6y ago
      I use them for progressive enhancement. If javascript is available, I'll add a dynamically generated href, or call .addEventListener("click", ...) and add behaviour to the link. Buttons can be used sometimes, but if you're wanting something that behaves like a link: middle click works, right click "Open in new Tab", Copy link, etc. then a button doesn't work. I prefer to use buttons to affect the state of the current page. And use anchor tags for all other navigation, even if I'm handling it with .addEventListener("click", ...). I suppose I could just hide the non-functional links, or add them dynamically with javascript. But that could affect layout.
      - chrismorgan 6y ago
        If it’s not going to work if JavaScript is unavailable, I would suggest either adding it dynamically with JavaScript, or else omitting the href attribute so that it’s not a link; this could be paired with hiding it, or just giving it attributes like title="JavaScript is required for this link to work" and style="cursor: not-allowed". (Maybe aria-hidden="true" too.)
        webstrand 6y ago
        That's a reasonable option, I'll have to try that. My only concern is that when an anchor tag has no href attribute, the styling is different. It usually behaves as plain text, if I remember correctly, which is really confusing if you expected a link. Nothing that styling can't fix, but that's why, historically, I have always tried provide an href tag, even if it's just href="javascript:void 0". Still, your solution is nicer in many ways, thanks.
        6y ago
detaro 6y ago
seems like the FAQ is outdated regarding the authors view on that: https://github.com/lambda-fairy/maud/issues/181 https://github.com/lambda-fairy/maud/issues/181
- lucideer 6y ago
  I hate to come across as elitist or something—noone's perfect, and I appreciate people building software libraries & releasing them, regardless of their experience as a programmer. But if someone's publishing a HTML templating system, and they don't have enough knowledge about HTML to understand the need for contextual escaping, I would have grave concerns about the Dunning-Kruger effect & the quality of any software that engineer writes.
  - vitno 6y ago
    Dunning-Kruger effect seems like a weird accusation to throw here. The whole basis of it is "a false sense of superiority", but the author is clearly willing to engage on this issue. I think a better way of terming this would be that you have concern the the author might not have enough domain expertise, which is very different than being incompetent. This gives me pause that Maud isn't right for a production system at this time, but is that so surprising for a 0.11 library?
    - lucideer 6y ago
      I suppose one does gain good experience and knowledge if one is receptive to feedback during the developing & maturing of a software project, so that is positive. I guess what I was more getting at was the thought process that goes "I'm going to develop and release a library in X domain", when ones knowledge of said domain is low. And then launching said library before one has really gained a lot of knowledge of that domain.
  - lfairy 6y ago
    I might be biased, as I'm the engineer that you're talking about, but that characterization feels unfair. Context-aware escaping is by no means common in the open source world—just look at Jinja or Handlebars. So unless you're knee-deep in an ecosystem that embraces it, it's easy to brush it off as unimportant.

bajsejohannes 6y ago

Another solution inspired by Mustache is https://github.com/maghoff/bart https://github.com/maghoff/bart

pjmlp 6y ago

> Note that Maud depends on the unstable procedural macro API, and so requires the nightly version of Rust. Oh well.

Keats 6y ago
There are many compile-time templates that work on stable: https://github.com/djc/askama https://github.com/djc/askama , https://github.com/maghoff/bart https://github.com/maghoff/bart , https://github.com/kaj/ructe https://github.com/kaj/ructe and https://github.com/Stebalien/horrorshow-rs https://github.com/Stebalien/horrorshow-rs Probably a few others I'm not aware of.
lfairy 6y ago
The API in question is stable now, so that will change very soon: https://github.com/lambda-fairy/maud/milestone/1 https://github.com/lambda-fairy/maud/milestone/1

deleted 6y ago

[deleted]

sradman 6y ago

Maud consists of template literals that can be embedded directly in Rust code. It is similar to lit-html and JSX but uses a syntax compatible with Rust rather than using XML style <element attribute=""> syntax. It looks similar to scripting languages like Haml/Pug.

ximm 6y ago

Does someone know of something similar for C?