Google's Templating Language | Hacker News Reader

Google's Templating Language

code.google.com

45 pointspowertower18 comments

The Closure Templates project is much more interesting IMO.

http://code.google.com/closure/templates/

They can be used server-side on the JVM, or client-side (compiled on the server side). They're pretty fast.

I wish template engines would have URL sanitization functions built into them (that remove javascript: and other URI schemes). I thought Closure Templates might have when I saw escapeUri, but it doesn't. (The similar-sounding esc_url in WordPress does remove javascript: and other problematic URI schemes.) User-submitted URLs should be sanitized, but it wouldn't hurt to have another layer of security when they are, and it would help when they aren't. I blogged about this: http://benatkin.com/2011/09/16/safe-html-from-a-template/

Closure Templates was also my first thought. I like them a lot and have combined them server-side with AppJet, which also runs on the JVM. A perfect match in my opinion. I have written a blog post about this: http://blog.jgate.de/closure-templates-for-appjet

It emphasizes separating logic from presentation: it is impossible to embed application logic in this template language.

StringTemplate for C++ then. http://www.stringtemplate.org/

Its distinguishing characteristic is that it strictly enforces model-view separation unlike other engines. Strict separation makes websites and code generators more flexible and maintainable; it also provides an excellent defense against malicious template authors.

You forgot the best part of StringTemplate: Terence Parr has even written a paper about it where he discusses some difficulties and solutions: http://www.cs.usfca.edu/~parrt/papers/mvc.templates.pdf

Fighting against malicious template authors is a losing battle I don't want to fight. I simply won't hire or work with somebody I consider malicious, and don't trust the general public to write templates for my system.

Zope tried that with "safe python" and TAL/TALES/METAL, and it was an utter abortion.

So someone almost ported Mustache. Makes me wonder: are the differences historical (e.g. the projects didn't know of it each other until well evolved), or are there good (C++-related?) reasons for the slightly different syntax?

Causation runs the other way. Mustache is a port of cTemplate. cTemplate has been around internally since the early 2000s (look at the author: it's Craig Silverstein, Google's employee #1) and was open-sourced in 2008, while Mustache is (c) 2009 and explicitly lists cTemplate as an influence.

Ah right. I stand corrected.

Pretty surprising how needlessly different this is from their soy templating language: http://code.google.com/closure/templates/

Probably explains why, when you search for ${, google explodes.

No, thats a JavaScript bug.

Maybe, but it doesn't look like $ is a special character.

haha, you're right- I saw "${{value}}" and thought it was the delimiter- but no, it actually prints $50 or whatever.

More detail?

It's #1 on the front page right now.

aka mustache {

Is this really Google's?

Yup. Look at the source for copyright information.

Reply on news.ycombinator.com