Escaping and Security

Where a value lands decides how it is escaped, and that is read from your template's own markup, so data can never escape its place. A template that cannot be made safe does not compile. On top of that, every page has a Content Security Policy with a fresh nonce, and every action passes its gates.

Where a value lands decides how it is written

The context of each value is worked out once, when the template compiles, from the HTML you wrote around it. Data cannot choose its own context, because the context is your markup.

The same data in each place, with a value that tries to break out:

<p>{{evil}}</p>
<div title="{{evil}}"></div>
<a href="{{link}}">A link</a>
<a href="/search?q={{evil}}">Search</a>
<div style="color: {{color}}"></div>
<input {{attrs}}>
<script nonce="{{nonce}}">
  var value = {{evil}};
  var text = "{{evil}}";
</script>

With evil as "><script>alert(1)</script>, link as javascript:alert(1) and color as red;background:url(javascript:alert(1)), the script never runs: the link becomes about:invalid#unsafe-url, the color becomes unsafe, and the rest is inert text.

Triple braces opt out. {{{value}}} and {{& value}} write the value as it is, wherever they stand. Use them only for HTML you built yourself, such as the output of web_foreach or web_template, whose values are escaped already. Never for something a visitor typed.

The same goes for the html pin of web_update, web_replace and web_insert: it is HTML. Run a visitor's text through a web_template first.

Some templates refuse to compile, with a message that says why

No single escaping is right for these shapes, so they are errors and not risks.

A partial anywhere but where text goes

A partial compiles on its own, starting in text, and must end in text too.

A branch that ends somewhere else

The next value would otherwise be escaped for a place it may not be in. With an {{else}}, the branches must agree with each other. Without one, or in a section or a loop that may run zero or many times, the block must end where it began.

The fourth one catches most people. A bare checked leaves the block in the middle of an attribute name, and checked="checked" ends where it began. <input {{attrs}}> with an object of attributes is the other way to write it.

A link whose scheme would come from data

A value followed by a : in your text could build javascript: out of the two.

A value that may be the scheme is checked together with the text before it, so {{a}}{{b}} cannot build javascript: either.

And the plain mistakes

A filter that does not exist, a block that is never closed, a closing tag for the wrong block, a second {{else}}, changed delimiters and a {{define}} used twice for one name are all errors with their line and column, too. So a typo shows up the first time the page renders, for you, and is never a blank spot for a visitor to find.

Every page has a Content Security Policy with a fresh nonce

Every page response carries this policy, with a new random nonce each time:

default-src 'self';
script-src 'self' 'nonce-RANDOM' https:;
style-src 'self' 'unsafe-inline' https:;
img-src 'self' data: blob: https:;
font-src 'self' data: https:;
media-src 'self' blob: https:;
connect-src 'self' https: wss:;
frame-src 'self' https:;
form-action 'self' https:;
frame-ancestors 'self';
base-uri 'self';
object-src 'none'

In short, a page may load what a website loads, and is refused what an injected string would need. To set your own policy, send Content-Security-Policy through the headers pin of web_render: yours then replaces this one, nonce included, so you take over keeping the runtime script allowed.

Next to the policy, a page gets X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin unless you set them yourself.

Scopes decide who may open a page

A web_page is gated like every other page: *public for anyone, *loggedin for any signed-in user, a scope of your own, or *ip: for addresses. With no scopes at all it opens for developers only. See Remote access control.

An action passes more gates than its page

1. Another website is refused. A POST the browser marks as coming from another site, or whose Origin is another host, gets a 403. That includes other subdomains of your domain. The session cookie on such a request is the visitor's, but the intent is not.
2. The page's scopes must admit the visitor, as for opening it.
3. The action's own scopes must admit the visitor, if it has any.
4. Without scopes of its own, the scopes of every web_page in the blueprint must admit the visitor.

A blueprint with a public page and an admin page therefore cannot leak the admin actions through the public page. The reverse is the catch: an action the public page uses needs scopes: ["*public"] of its own in that blueprint, and a page without scopes closes every action without scopes to anyone but developers.

An action name means nothing outside its blueprint, and a name the blueprint does not have is a 404. A script outside a browser sends none of the headers above and passes the first gate, so never treat it as authentication: the scopes do that job.

A failure tells the visitor little

A visitor who reaches a broken page reads that it failed. Why it failed goes to the log, and on the page or in the action's answer only to the entity's blueprint developers: sessions with the setting_blueprint_view_all permission. So a template error never shows a stranger how the page is built, and you can debug a live page by opening it signed in.

On the block, a template error sets success to false and puts the message on error, and the page answers with status 500.

Next steps