Safe JavaScript Templates

Question

I am looking to allow users to create templates to display their data, and these templates are to be rendered using JavaScript. I was wondering if it was possible to safely do this? I just need simple things like loops and if-else statements and of course accessing and printing values of variables in a given object.

Are there any template libraries that allow this, or easy methods for accomplishing this task?

Answer 1

The following are considering possibly Node.js server-safe options (no arbitrary code execution / infinite loops). Browser safe (XSS) is hard / impossible.

Mustache appears to be explicitly designed to be safe for user consumption and prevent infinite loops to avoid server DoS: https://github.com/janl/mustache.js/

You can also look for JavaScript Liquid ports: Liquid templating for Node.js such as https://github.com/liquid-lang/liquid-node since Liquid is the default GitHub pages choice, so it should be safe to run on the server.

Options which are known not to be safe:

• https://mozilla.github.io/nunjucks/templating.html "nunjucks does not sandbox execution so it is not safe to run user-defined templates or inject user-defined content into template definitions."