-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for eval-less template execution #1934
Comments
|
Thanks for expressing your interest, @salmin89, and do let me know how you make out with your test! |
@legrego your solution worked perfectly. I will copy the package for now, but I'd love to see it natively supported by handlebars. If you don't get any response, are there any plans on publishing your package as a standalone solution? |
@salmin89, happy to hear that.
We are discussing this as an alternative here: elastic/kibana#150522. My personal preference is to have this become a part of the official distribution, so that we don't have to deal with compatibility changes across the various versions of Handlebars |
For those looking, I created a kibana fork to publish |
This is great and working for many cases. I came across a use case that isn't supported: nested expressions. Example, the first block is working, but the second block isn't omitting the nested CUSTOM_HELPER
Chances this could make it into the library? |
Cheers for the library, and sharing the work with the open source community, so great to have a path forward on this while handlebars upstream is blocked. Just out of interest I wonder if another solution to this probably could be shipping the @legrego @thomheymann @watson am I missing something that you might have found in the trenches? Would this not actually solve the issue for some reason or another? |
I forgot to mention in my comment, that I had started a project https://handlebars-ng.knappi.org a while ago. It should also create a language spec. I stopped because there seemed to be no interest and I didn't need it personally. Its a bit stale now, but I would invite everybody who wants to contribute. Although this might be too late now... |
⁵
The documentation at handlebars.js uses workers to run templates in the playground. I did this to prevent the main thread from being stuck in endless loops. |
One of the ways Kibana leverages Handlebars is via user-supplied templates, which are then executed in the browser.
We recently, finally, removed
script-src 'unsafe-eval'
from our Content Security Policy. The most challenging part of this exercise was finding a way to get Handlebars to execute templates without the need for dynamic code generation (in other words, withouteval
).Inspired by @nknapp's comment in #1443, we took a stab at executing templates by walking the Handlebars-generated AST. We've had our implementation running in production for a little while now, and it's working well for us.
I won't go into too many details about our approach here, but I'll instead refer you to our implementation, which includes a descriptive README:
https://github.com/elastic/kibana/tree/main/packages/kbn-handlebars
If there is a community interest for this, we would be happy to contribute our work to the Handlebars project. Our approach would live alongside the existing approach, rather than replace it. The performance tradeoff would not be acceptable for all users.
So, with all that said:
eval
-less execution?aside: I am just the person asking the questions, credit for this work goes to @watson and @thomheymann
The text was updated successfully, but these errors were encountered: