Class: LexxyVariables::Renderers::Liquid

Inherits:
Object
  • Object
show all
Defined in:
lib/lexxy_variables/renderers/liquid.rb

Overview

Opt-in renderer that resolves placeholders through Liquid, enabling dotted access, drops (e.g. company.name }), and filters. Requires the liquid gem. It is loaded here, when a host instantiates this renderer, so apps on the default renderer never pull it in.

Security: because Liquid does interpret } and %, any such syntax the author typed as plain text is entity-escaped BEFORE our own placeholders are revealed, so users cannot forge Liquid. Only the nonce-protected placeholders this pipeline emitted become real Liquid tags.

assigns is the Hash passed to Liquid: string values and/or Liquid::Drop instances. Drops must escape their own output, since Liquid output is emitted html_safe after sanitization.

Instance Method Summary collapse

Constructor Details

#initialize(error_mode: :lax) ⇒ Liquid

Returns a new instance of Liquid.



17
18
19
20
 
# File 'lib/lexxy_variables/renderers/liquid.rb', line 17

def initialize(error_mode: :lax)
  require "liquid"
  @error_mode = error_mode
end

Instance Method Details

#render(html, nonce:, assigns:) ⇒ Object 



22
23
24
25
26
27
 
# File 'lib/lexxy_variables/renderers/liquid.rb', line 22

def render(html, nonce:, assigns:)
  html = html.gsub("{{", "{{").gsub("{%", "{%")
  html = html.gsub(Placeholder.pattern(nonce)) { "{{ #{$1} }}" }

  ::Liquid::Template.parse(html, error_mode: @error_mode).render(assigns)
end