Shopify/liquid
Liquid
Liquid is a secure template engine and markup language used to generate dynamic HTML or text by combining static templates with backend data. It functions as a web template renderer that transforms markup into final output while restricting available logic to prevent arbitrary code execution.
The engine focuses on secure markup execution, providing a restricted environment where user-provided templates cannot access sensitive system data. It utilizes a safe evaluation sandbox to ensure that only a predefined set of instructions can be executed.
The system includes capabilities for template syntax validation, detecting invalid markup and undefined variables during the authoring process. It also supports the creation of custom template logic through a system of tags and filters, which can be isolated within scoped environments to prevent naming conflicts.
Features
- Sandboxed Code Execution Environments - Provides a restricted execution environment to prevent user-provided templates from accessing sensitive system data.
- Templating Languages - Provides a secure, customer-facing markup language for generating dynamic HTML and text.
- Dynamic Markup Rendering - Provides a system for converting markup languages into dynamic web content from backend data.
- Hierarchical Variable Resolvers - Resolves data keys by traversing hierarchical parent contexts within the template environment.
- Dynamic Templates - Implements a templating language and engine to generate dynamic server-side output from logic.
- AST-Based Template Parsing - Transforms template strings into an abstract syntax tree for structural analysis and execution.
- Context-Aware Variable Resolution - Resolves variables by looking up keys within a provided data object across scoped environments.
- Template Security Policies - Applies constraints to the rendering engine to prevent injection attacks and unauthorized code execution in user-edited templates.
- Execution Sandboxing - Restricts template operations to a predefined set of safe instructions to prevent arbitrary code execution.
- Abstract Syntax Tree Parsing - Implements an AST parser to transform template strings into a structured node tree for subsequent rendering.
- Template Syntax Validators - Analyzes templates to detect invalid markup and provide detailed feedback during the authoring process.
- HTML Template Renderers - Generates HTML output by merging data dictionaries with predefined templates and isolated custom tags.
- Dynamic Template Rendering - Performs runtime evaluation of templates by merging static markup with dynamic backend data.
- Template Rendering Engines - Processes and combines markup with dynamic data to generate final HTML or text output.
- Secure User-Editable Templates - Provides a secure mechanism for non-developers to edit web templates without risking arbitrary code execution.
- Template Execution Engines - Functions as a runtime that processes templates and data to produce final string outputs securely.
- Template Logic - Provides syntax and control structures, including custom tags and filters, for dynamic content generation.
- Tag-And-Filter Dispatch - Resolves custom template identifiers to specific logic handlers via a registry of tags and filters.
- Template Compilation - Transforms string templates into executable logic in multiple stages to handle complex control flows.
- Multi-Pass Compiler Pipelines - Processes templates through multiple sequential stages to resolve conditional logic and loops before final output.
- Abstract Syntax Tree Parsers - Converts template strings into a structured tree of nodes for analysis and rendering.
- Logic Isolation - Isolates custom tags and filters within scoped environments to prevent namespace collisions.
- Isolate-Based Logic Scoping - Provides isolated environments for custom tags and filters to prevent naming conflicts and restrict functionality.
- Registry-Based Tag Dispatch - Maps custom template identifiers to specific logic handlers using a central registry of tags and filters.
- Template Engines - Safe template language for web apps.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
