FreshMarker and ⊻, ¬, ≠, ≤, ≥, ∨, ∧

Sometimes a new feature also needs to be a bit of fun. When updating the FreshMarker Grammar, I noticed that the operators lt, gt, gte and lte were still present. These are variants of the usual <, >, <= and >= operators and are reminiscent of the opcodes of a long-forgotten era when assembler languages still roamed the steppes of programming. Since FreshMarker was given its Unicode capabilities by CongoCC, the question arose as to why not allow ≠ and other operator characters in the template.

FreshMarker und OWASP

It will come as no surprise that FreshMarker, like all other template engines, must take precautions against template injection. Template injection is a security vulnerability that occurs when an application handles templates insecurely. Templates are prefabricated files or strings with placeholders that are replaced by data from users or other sources. Similar to FreeMarker, FreshMarker also has an escape mechanism that detects special characters in the interpolations using a harmless variant. If the standard mechanism is not enough, OWASP can help out.

FreshMarker Partial Template Reduction

Some blog posts are about ideas and not solutions. This has the pleasant advantage for the author that the content of the contribution does not (yet) have to work. It also saves the developer work if the audience does not appreciate the topic. When working with templates, there are always a number of variables that are processed in a template with always the same value. It would be nice if you could save computing time there.