Hacker News Reader

Comment by june_twenty | Hacker News Reader

There is no issue with producing HTML with string templates.

> There is no issue with producing HTML with string templates.

There is no issue, until you forget to use escaping (or use the wrong one) for one variable, and someone uses that hole to inject arbitrary HTML and/or JS into your page. As long as all your escaping of interpolated variables is perfect, producing HTML with string templates is fine.

That's just a bad system, not inherent to templating systems in general. Django (python) got it right: All variables that go into a template are escaped by default, you have to go out of your way to tell it not to do that.

String formatting on the other hand, yeah, no good way like that in a language not designed for it.

Not sure which you and GP meant by "string templates".

Unless the template is aware of the semantics of the html being output, it can’t always know how to escape. E.g. the escaping rules are different for a css variable embedded in an inline style compared to using it in a javascript context.

That is what made JSX so neat.

and modern templating systems do! https://pkg.go.dev/html/template

> This package understands HTML, CSS, JavaScript, and URIs.

No JSX needed.

Failure to properly escape HTML and SQL used to be the most common security issues people found (and perhaps bugs).

How is this problem solved using most of the libraries people have mentioned in this discussion that don't use strings?

Why don't you just look up one of those libraries? Most of them have some sort of description of how they work.

You'll generally have two functions:

  addFragment : (String, IntermediateHtmlAST) -> IntermediateHtmlAST

  renderHtml : IntermediateHtmlAST -> String

There is a sanitation pass that occurs either in the final conversion of the intermediate data structure to an HTML string (renderHtml), or immediately on the function call (addFragment).

This is similar to how database query libraries let you build up a SQL query via an intermediate data structure and then convert that to a prepared SQL statement (most common) or do data sanitization on the input fragment (less ideal).

I use string templates for small hidden services and I have never ever once ran into a problem. So yeah, really no issue. Anyone complaining otherwise is being really picky about subtleties in particular contexts. At large they completely work!

Reply on news.ycombinator.com