Comments (4)
i can come up with a PR to get this feature implemented
from request-baskets.
Hi @UiP9AV6Y
Thank you for your contribution!
It's an interesting idea, although the templating was never an advertised feature of this service, more like a convenience.
For standard pages (index, baskets, basket) I do not need the power of Sprig, I guess.
For responses Sprig probably offers more flexible and powerful language that is easier to use, but it comes with a price. As I can see the language offers some powerful features that can easily lead to a security issues, especially since the template themselves can be created by any visitor of the web-site w/o authentication. I appreciate your effort to mitigate that by removing 3 known functions that may lead to an issue. However, if tomorrow a new version of Sprig will arrive and introduce a new dangerous function - this can lead to a security vulnerabilities by simply automatic update.
From that point of view it would be great to introduce Sprig as an alternative template language that is not used by default. And extra parameter for the service to switch between template engines. I think this should be fair: keep the default language from Go lang, that is simpler, yet safer, and let users configure more complex engine at will with responsibility of higher risk.
What do you think?
from request-baskets.
For standard pages (index, baskets, basket) I do not need the power of Sprig, I guess.
i know. i just applied it to all templating use for consistency reasons
As I can see the language offers some powerful features that can easily lead to a security issues
can you name an example? the current iteration of the templating feature already has access to request data. using sprig offers simply new ways to process that data + generate (non-sensitive) data (e.g. time, date, random strings)
However, if tomorrow a new version of Sprig will arrive and introduce a new dangerous function - this can lead to a security vulnerabilities by simply automatic update.
i assume you do not blindly update dependencies without checking what has actually changed b/c the same can be said about any 3rd party code
keep the default language from Go lang, that is simpler, yet safer, and let users configure more complex engine at will with responsibility of higher risk.
user
refers to the server operator here, right?
from request-baskets.
The ability to build a dynamic response is pretty important because many webhook subscriptions require a dynamic response in order to verify the endpoint is willing to accept the webhook.
from request-baskets.
Related Issues (20)
- Please add dockerhub build to this repo HOT 1
- getAndAuthBasket should be called getAuthenticatedBasket HOT 1
- add ability to get full raw GET parameters in the "GET" green header HOT 4
- SSL Support HOT 1
- Provide parameter to instantiate basket on startup HOT 8
- Provide ARM based image on docker hub HOT 5
- Add 'copy to clipboard' button to UI HOT 1
- Host header is missing from the Headers section HOT 1
- Running using docker run and setting a custom master token HOT 1
- Migrate to go modules HOT 1
- basket expiration HOT 1
- Restrict creation of new baskets HOT 3
- Allow hosting the webapp as non-root HOT 2
- Error installing version 1.2.0 HOT 3
- Add allow/deny feature for forward URLs HOT 4
- Bootstrap Upgrade/Dark Mode HOT 9
- [Feature] Support create basket and configure response HOT 1
- Handling Multipart HOT 1
- [SSRF] CVE-2023-27163 HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from request-baskets.