5 ms·

There is no issue with producing HTML with string templates.

fallat 3y ago
I use string templates for small hidden services and I have never ever once ran into a problem. So yeah, really no issue. Anyone complaining otherwise is being really picky about subtleties in particular contexts. At large they completely work!
cesarb 3y ago
> There is no issue with producing HTML with string templates. There is no issue, until you forget to use escaping (or use the wrong one) for one variable, and someone uses that hole to inject arbitrary HTML and/or JS into your page. As long as all your escaping of interpolated variables is perfect, producing HTML with string templates is fine.
- Izkata 3y ago
  That's just a bad system, not inherent to templating systems in general. Django (python) got it right: All variables that go into a template are escaped by default, you have to go out of your way to tell it not to do that. String formatting on the other hand, yeah, no good way like that in a language not designed for it. Not sure which you and GP meant by "string templates".
  - ec109685 3y ago
    Unless the template is aware of the semantics of the html being output, it can’t always know how to escape. E.g. the escaping rules are different for a css variable embedded in an inline style compared to using it in a javascript context. That is what made JSX so neat.
    - theamk 3y ago
      and modern templating systems do! https://pkg.go.dev/html/template https://pkg.go.dev/html/template > This package understands HTML, CSS, JavaScript, and URIs. No JSX needed.
nitwit005 3y ago
Failure to properly escape HTML and SQL used to be the most common security issues people found (and perhaps bugs).
- manicennui 3y ago
  How is this problem solved using most of the libraries people have mentioned in this discussion that don't use strings?
  - nitwit005 3y ago
    Why don't you just look up one of those libraries? Most of them have some sort of description of how they work.
  - dwohnitmok 3y ago
    You'll generally have two functions: addFragment : (String, IntermediateHtmlAST) -> IntermediateHtmlAST renderHtml : IntermediateHtmlAST -> String There is a sanitation pass that occurs either in the final conversion of the intermediate data structure to an HTML string (renderHtml), or immediately on the function call (addFragment). This is similar to how database query libraries let you build up a SQL query via an intermediate data structure and then convert that to a prepared SQL statement (most common) or do data sanitization on the input fragment (less ideal).

I use string templates for small hidden services and I have never ever once ran into a problem. So yeah, really no issue. Anyone complaining otherwise is being really picky about subtleties in particular contexts. At large they completely work!

cesarb 3y ago

> There is no issue with producing HTML with string templates. There is no issue, until you forget to use escaping (or use the wrong one) for one variable, and someone uses that hole to inject arbitrary HTML and/or JS into your page. As long as all your escaping of interpolated variables is perfect, producing HTML with string templates is fine.

Izkata 3y ago
That's just a bad system, not inherent to templating systems in general. Django (python) got it right: All variables that go into a template are escaped by default, you have to go out of your way to tell it not to do that. String formatting on the other hand, yeah, no good way like that in a language not designed for it. Not sure which you and GP meant by "string templates".
- ec109685 3y ago
  Unless the template is aware of the semantics of the html being output, it can’t always know how to escape. E.g. the escaping rules are different for a css variable embedded in an inline style compared to using it in a javascript context. That is what made JSX so neat.
  - theamk 3y ago
    and modern templating systems do! https://pkg.go.dev/html/template https://pkg.go.dev/html/template > This package understands HTML, CSS, JavaScript, and URIs. No JSX needed.

nitwit005 3y ago

Failure to properly escape HTML and SQL used to be the most common security issues people found (and perhaps bugs).

manicennui 3y ago
How is this problem solved using most of the libraries people have mentioned in this discussion that don't use strings?
- nitwit005 3y ago
  Why don't you just look up one of those libraries? Most of them have some sort of description of how they work.
- dwohnitmok 3y ago
  You'll generally have two functions: addFragment : (String, IntermediateHtmlAST) -> IntermediateHtmlAST renderHtml : IntermediateHtmlAST -> String There is a sanitation pass that occurs either in the final conversion of the intermediate data structure to an HTML string (renderHtml), or immediately on the function call (addFragment). This is similar to how database query libraries let you build up a SQL query via an intermediate data structure and then convert that to a prepared SQL statement (most common) or do data sanitization on the input fragment (less ideal).