Letterpress.Renderer.Filters (Letterpress v0.1.0)

Implements the compiler-reserved final output-context filter.

The trusted compiler appends this filter after every delivery expression. User source cannot name it directly. It escapes or validates the final value after ordinary Liquid filters have run, which prevents a preceding filter from bypassing the context selected during compilation.

This module is part of the renderer implementation. Template authors should declare the correct variable context instead of calling it.

Examples

iex> Letterpress.Renderer.Filters.escape("<Ada & Grace>", "html_text")
{:ok, "&lt;Ada &amp; Grace&gt;"}

iex> Letterpress.Renderer.Filters.escape("javascript:alert(1)", "url")
:error

Summary

Functions

apply(arg1, arg2)

Implements the custom-filter callback expected by Solid.render/3.

escape(value, arg2)

Escapes or validates a value for a compiler-proven context.

Functions

apply(arg1, arg2)

@spec apply(String.t(), list()) :: {:ok, String.t()} | :error

Implements the custom-filter callback expected by Solid.render/3.

Only the compiler-reserved "letterpress_escape" filter and its two arguments are accepted.

escape(value, arg2)

@spec escape(term(), String.t()) :: {:ok, String.t()} | :error

Escapes or validates a value for a compiler-proven context.

HTML text and attribute contexts are escaped. Subjects reject CR, LF, NUL, and oversized output. URLs reject control characters, protocol-relative values, and absolute schemes outside the render call's allowlist.

Example

iex> Letterpress.Renderer.Filters.escape("https://example.test/?a=1&b=2", "url")
{:ok, "https://example.test/?a=1&amp;b=2"}