New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for eval-less template execution #1934
Comments
|
Thanks for expressing your interest, @salmin89, and do let me know how you make out with your test! |
@legrego your solution worked perfectly. I will copy the package for now, but I'd love to see it natively supported by handlebars. If you don't get any response, are there any plans on publishing your package as a standalone solution? |
@salmin89, happy to hear that.
We are discussing this as an alternative here: elastic/kibana#150522. My personal preference is to have this become a part of the official distribution, so that we don't have to deal with compatibility changes across the various versions of Handlebars |
For those looking, I created a kibana fork to publish |
This is great and working for many cases. I came across a use case that isn't supported: nested expressions. Example, the first block is working, but the second block isn't omitting the nested CUSTOM_HELPER
Chances this could make it into the library? |
One of the ways Kibana leverages Handlebars is via user-supplied templates, which are then executed in the browser.
We recently, finally, removed
script-src 'unsafe-eval'
from our Content Security Policy. The most challenging part of this exercise was finding a way to get Handlebars to execute templates without the need for dynamic code generation (in other words, withouteval
).Inspired by @nknapp's comment in #1443, we took a stab at executing templates by walking the Handlebars-generated AST. We've had our implementation running in production for a little while now, and it's working well for us.
I won't go into too many details about our approach here, but I'll instead refer you to our implementation, which includes a descriptive README:
https://github.com/elastic/kibana/tree/main/packages/kbn-handlebars
If there is a community interest for this, we would be happy to contribute our work to the Handlebars project. Our approach would live alongside the existing approach, rather than replace it. The performance tradeoff would not be acceptable for all users.
So, with all that said:
eval
-less execution?aside: I am just the person asking the questions, credit for this work goes to @watson and @thomheymann
The text was updated successfully, but these errors were encountered: