That post is really really cool, I use PEG but would like to be able to create my own PEG one day (I tried different ones and previously used PEG.js which is quite powerful).
I was never really happy with any templating language, none of them ever really fit and customization was never satisfactory. I started using sh as templating language (https://mkws.sh/pp.html) and never been happier. Makes sense, UNIX tools are great for processing plain text and also for displaying plain text in as human friendly way as possible. Just use standard UNIX tools for processing and outputting the text in any kind of file types.
😬 One rough consensus about templating languages is that they shouldn’t be too capable*; you want your logic in the program, not the templates.
In light of that, a template language that’s capable enough to, say, upload all your data to Elbonia and then wipe your disk sounds particularly dangerous to me. What’s the pp equivalent of Johnny Tables?
Plus the fact that sh has IMHO the ugliest syntax for conditionals/loops outside of Brainf*ck…
* (I was going to say “they shouldn’t be Turing-complete”, but I wouldn’t be surprised if someone has figured out how to implement Towers of Hanoi in Liquid…)
It’s a matter of responsability, who’s responsible for the safety, the programmer or the language? You ilustrated that pretty good with the Johnny Tables example, who’s responsabile for that, SQL (or C# I believe?), or the programmer? Any programming language is “dangerous”, also, any programmer.
It’s as safe as any shell script you write locally and run.
Ugly is relative, I also found it ugly initally, now I find it elegant.
Logic is where you decide to put it, you could write separate programs for the logic the UNIX way and only use pp for presenting the output.
In the context of using it for generating static HTML files, I personally prefer to see it as progressive enhancement for the CLI. You’re already using the standard CLI tools to show data on your terminal, why not use the same CLI tools to show data on a web site, considering a web site is just a way to show off local data in a public way.
It’s as safe as any shell script you write locally and run.
If you use it only with local data, yes. But templates very often run on untrusted data from the network. If your templater doesn’t escape that properly, it’s open to injection attacks; and if the data that failed to be quoted is part of a shell command, you’ve got a full RCE.
logic is where you decide to put it.
Sure, but there’s a lot of evidence from experience that it’s better to separate logic from templates.
If you use it only with local data, yes. But templates very often run on untrusted data from the network. If your templater doesn’t escape that properly, it’s open to injection attacks; and if the data that failed to be quoted is part of a shell command, you’ve got a full RCE.
Agree, I’m only using locally for now. In case of untrusted data, just make sure you properly sanitize it, again matter of responsability.
Sure, but there’s a lot of evidence from experience that it’s better to separate logic from templates.
Agree again, it’s a good idea to develop separate programs for logic and only use pp for displaying the output.
I was going to say “they shouldn’t be Turing-complete”, but I wouldn’t be surprised if someone has figured out how to implement Towers of Hanoi in Liquid
Liquid is definitely turing complete. Being amazingly poorly designed and not fit for purpose doesn’t not prevent completeness ;)
Nice post! I did a similar project last year cloning Jinja in Python but writing the parser by hand.
Thanks, the idea is that I can run user-written templates, e.g. I define the context, the methods etc.
Kinda like liquid but more powerful and without the default standard library
That post is really really cool, I use PEG but would like to be able to create my own PEG one day (I tried different ones and previously used PEG.js which is quite powerful).
I read https://craftinginterpreters.com/ but mostly followed the examples.
Can’t you use PEG to write your own PEG implementation?
Too true, don’t know what to answer to that
I was never really happy with any templating language, none of them ever really fit and customization was never satisfactory. I started using
shas templating language (https://mkws.sh/pp.html) and never been happier. Makes sense, UNIX tools are great for processing plain text and also for displaying plain text in as human friendly way as possible. Just use standard UNIX tools for processing and outputting the text in any kind of file types.😬 One rough consensus about templating languages is that they shouldn’t be too capable*; you want your logic in the program, not the templates.
In light of that, a template language that’s capable enough to, say, upload all your data to Elbonia and then wipe your disk sounds particularly dangerous to me. What’s the pp equivalent of Johnny Tables?
Plus the fact that sh has IMHO the ugliest syntax for conditionals/loops outside of Brainf*ck…
* (I was going to say “they shouldn’t be Turing-complete”, but I wouldn’t be surprised if someone has figured out how to implement Towers of Hanoi in Liquid…)
There is a liquid json parser :) https://github.com/culturekings/shopify-json-parser
It’s a matter of responsability, who’s responsible for the safety, the programmer or the language? You ilustrated that pretty good with the Johnny Tables example, who’s responsabile for that, SQL (or C# I believe?), or the programmer? Any programming language is “dangerous”, also, any programmer.
It’s as safe as any shell script you write locally and run.
Ugly is relative, I also found it ugly initally, now I find it elegant.
Logic is where you decide to put it, you could write separate programs for the logic the UNIX way and only use
ppfor presenting the output.In the context of using it for generating static
HTMLfiles, I personally prefer to see it as progressive enhancement for the CLI. You’re already using the standard CLI tools to show data on your terminal, why not use the same CLI tools to show data on a web site, considering a web site is just a way to show off local data in a public way.If you use it only with local data, yes. But templates very often run on untrusted data from the network. If your templater doesn’t escape that properly, it’s open to injection attacks; and if the data that failed to be quoted is part of a shell command, you’ve got a full RCE.
Sure, but there’s a lot of evidence from experience that it’s better to separate logic from templates.
Agree, I’m only using locally for now. In case of untrusted data, just make sure you properly sanitize it, again matter of responsability.
Agree again, it’s a good idea to develop separate programs for logic and only use
ppfor displaying the output.Liquid is definitely turing complete. Being amazingly poorly designed and not fit for purpose doesn’t not prevent completeness ;)
Did you mean to take this series down? It 404s.