Templating systems have an inherent tension between power and security. A lot of them will cough up straight code execution if you can phrase it nicely. (e.g.

Templating systems have an inherent tension between power and security. A lot of them will cough up straight code execution if you can phrase it nicely. (e.g. I've seen Markdown which does YAML syntax highlighting. This happened to be implemented by actually parsing the YAML. And that's the ballgame.) Or, for ones which only let you access methods on an object passed to you, sometimes the person implementing that feature is not on the same page with the guy who added User#promote_to_admin!