How to handle {:safe, body}?

[ghost]

The temple function returns {:safe, body} so it takes Phoenix.HTML.safe_to_string/1 to render.

But when the template is a component put with c, it should be {:safe, body} to not get escaped.

This adds complexity because some templates would have Phoenix.HTML.safe_to_string/1 and some would not.

I guess Phoenix handles the tuple internally but I’m using Temple with Plug only.

Is there a config to take just the body content without :safe tuple?

I need escaping so EEx.SmartEngine wouldn’t cut it.

Thanks!

EDIT

I started doing {:safe, body} = View.render(conn.assigns) in plugs like a normal person.
Using Phoenix.HTML function was where I was stuck.

[mhanberg]

Can you provide an example? I'm not totally understanding the problem yet.

[ghost]

My project is using HTMX.

So it sends a whole page at first then sends components after that.

# router
get “/foo“ do
  send_resp(conn, :ok, View.foo(conn.assigns))
end

get “/foo/bar“ do
  send_resp(conn, :ok, View.bar(conn.assigns))
end

# view
def foo(_assigns) do
  temple do
    c &bar/1
  end
  |> Phoenix.HTML.safe_to_string()
end

def bar(_assigns) do
  temple do
    # some content ...
  end
  # `safe_to_string’ is needed when it’s sent to a plug. 
  # But it should not when it’s a `c` component.
  # |> Phoenix.HTML.safe_to_string()
end

What I want is temple returning the body without the {:safe, body} tuple. (but with sanitisation)

[mhanberg]

Did you try calling safe_to_string from the router?

[ghost]

Yes, but the :safe tuple feels like a view concern that should be contained in the view module.

Would you recommend to have it in plug modules for every send?

I also thought going EEx.SmartEngine then separately escaping body with register_before_send

[mhanberg]

If it helps, I believe the "Phoenix.Controller.render" function in Phoenix is what call safe_to_string, so it's really the same concept.

Also, if it helps, you can have a function called View.render that takes the component and assigns and have that call safe_to_string, basically the same thing tho

[ghost]

That's what I thought complexity. I really like Temple but this :safe tuple is making it less complete for me.

Anyway, thanks for the help! I'll try to escape HTML in a separate process without relying on Phoenix.HTML.Safe.

A little change on the doc might be helpful too. I'll push an update for the default engine.