Text::Xslate::Manual::Cookbook - How to cook Xslate templates
The Xslate cookbook is a set of recipes showing Xslate features.
Managing HTML forms is an important issue on web applications. You'd better to use modules that manage HTML forms, rather than do something with templates by yourself. This section proposes two basic solutions: using FillInForm and HTML form builders.
In both solutions, one should not use the mark_raw filter in templates, which easily makes security holes. Instead, application code should be responsible to call the mark_raw function that Text::Xslate can export.
mark_raw filter
mark_raw function
Text::Xslate
One solution to manage HTML forms is to use FillInForm modules with the block filter syntax.
Example code using HTML::FillInForm:
HTML::FillInForm
#!perl -w use strict; use Text::Xslate qw(html_builder); use HTML::FillInForm; # HTML::FillInForm::Lite is okay sub fillinform { my($q) = @_; my $fif = HTML::FillInForm->new(); return html_builder { my($html) = @_; return $fif->fill(\$html, $q); }; } my $tx = Text::Xslate->new( function => { fillinform => \&fillinform, }, ); my %vars = ( q => { foo => "<filled value>" }, ); print $tx->render_string(<<'T', \%vars); FillInForm: : block form | fillinform($q) -> { <form> <input type="text" name="foo" /> </form> : } T
Output:
FillInForm: <form> <input type="text" name="foo" value="<filled value>" /> </form>
Because HTML::FillInForm::Lite provides fillinform function, it becomes more simple:
fillinform
use HTML::FillInForm::Lite qw(fillinform); my $tx = Text::Xslate->new( function => { fillinform => html_builder(\&fillinform) }, );
From 1.5018 on, html_builder_module are supported for HTML builder modules like HTML::FillInForm. Just import HTML builder functions with html_builder_module option.
html_builder_module
my $tx = Text::Xslate->new( html_builder_module => [ 'HTML::FillInForm::Lite' => [qw(fillinform)] ], );
See also HTML::FillInForm or HTML::FillInForm::Lite for details.
Another solution to manage HTML forms is to use form builders. In such cases, all you have to do is to apply mark_raw() to HTML parts.
mark_raw()
Here is a PSGI application that uses HTML::Shakan:
HTML::Shakan
#!psgi use strict; use warnings; use Text::Xslate qw(mark_raw); use HTML::Shakan; use Plack::Request; my $tx = Text::Xslate->new(); sub app { my($env) = @_; my $req = Plack::Request->new($env); my $shakan = HTML::Shakan->new( request => $req, fields => [ TextField(name => 'name', label => 'Your name: ') ], ); my $res = $req->new_response(200); # do mark_raw here, not in templates my $form = mark_raw($shakan->render()); $res->body( $tx->render_string(<<'T', { form => $form }) ); <!doctype html> <html> <head><title>Building form</title></head> <body> <form> <p> Form:<br /> <: $form :> </p> </body> </html> T return $res->finalize(); } return \&app;
<!doctype html> <html> <head><title>Building form</title></head> <body> <form> <p> Form:<br /> <label for="id_name">Your name</label> <input id="id_name" name="name" type="text" value="<Xslate>" /> </p> </body> </html>
See also HTML::Shakan for details.
Use template cascading, which is a super-set of the WRAPPER directive.
WRAPPER
wrapper.tx:
<div class="wrapper"> block content -> { } </div>
content.tx
: cascade wrapper : override content -> { Hello, world! : }
<div class="wrapper"> Hello, world! </div>
Xslate supports template cascading, which allows you to extend templates with block modifiers. It is like traditional template inclusion, but is more powerful.
This mechanism is also called as template inheritance.
See also "Template cascading" in Text::Xslate.
Use Data::Section::Simple, and the path option of new(), which accepts HASH references which contain $file_name => $content mapping.
Data::Section::Simple
path
new()
$file_name => $content
use Text::Xslate; use Data::Section::Simple; my $vpath = Data::Section::Simple->new()->get_data_section(); my $tx = Text::Xslate->new( path => [$vpath], ); print $tx->render('child.tx'); __DATA__ @@ base.tx <html> <body><: block body -> { :>default body<: } :></body> </html> @@ child.tx : cascade base; : override body -> { child body : } # endblock body
This feature is directly inspired by Text::MicroTemplate::DataSection, and originated from Mojolicious.
See also Data::Section::Simple, Text::MicroTemplate::DataSection, and Mojolicious.
Because Xslate escapes only HTML meta characters, you must escape JavaScript meta characters by yourself when you put data into <script> ... </script> sections.
<script> ... </script>
JSON module is not suitable because it doesn't escape some meta characters such as "</script>".
JSON
"</script>"
It is better to use utilities proven to be secure for JavaScript escaping to avoid XSS. JavaScript::Value::Escape helps you for this aim.
my $tx = Text::Xslate->new( module => ['JavaScript::Value::Escape' => [qw(js)]], ); my %params = ( user_input => '</script><script>alert("XSS")</script>', ); print $tx->render_string(<<'T', \%params); <script> document.write('<: $user_input | html | js :>'); var user_input = '<: $user_input | js :>'; </script> T
You'd better to consult the security experts on more complex cases.
There's no silver bullet to parse structured texts in secure ways. You'd better to consult the security experts to do so.
Some CPAN module might help you. See String::Filter for example.
You can register any functions including _(), so no specific techniques are required.
_()
For example:
use I18N::Handle; # I18N::Handle installs the locale function "_" to the global namespace. # (remember the symbol *_ is global) I18N::Handle->new( ... )->speak('zh_tw'); my $tx = Text::Xslate->new( function => { _ => \&_, }, );
Then in your templates:
<: _('Hello %1', $john ) :>
See also: I18N::Handle, App::I18N.
fork()
It is a good idea to load templates in preforking-model applications. Here is an example to load all the templates which is in a given path:
use File::Find; my $path = ...; my $tx = Text::Xslate->new( path => [$path], cache_dir => $path, ); # pre-load files find sub { if(/\.tx$/) { my $file = $File::Find::name; $file =~ s/\Q$path\E .//xsm; # fix path names $tx->load_file($file); } }, $path; # fork and render ...
Text::Xslate::Manual
Text::Xslate::Manual::FAQ
To install Text::Xslate, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Text::Xslate
CPAN shell
perl -MCPAN -e shell install Text::Xslate
For more information on module installation, please visit the detailed CPAN module installation guide.