My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site.

However, I'm not sure if it's a good idea to give users the control of being able to access a template engine.

Is this a bad thing? How should I restrict access, or should I just totally rethink the strategy?


From the Twig homepage:

Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a template language for applications where users may modify the template design.

and farther down:

Sandboxing: Twig can evaluate any template in a sandbox environment where the user has access to a limited set of tags, filters, and object methods defined by the developer. Sandboxing can be enabled globally or locally for just some templates:

 {{ include('page.html', sandboxed = true) }}

So, all you have to do is sandbox the user templates and you should be fine

  • Beautiful, thanks! I have to wait a minute before marking your answer correct but I will when I can. – Dubstaphone Nov 10 '15 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.