Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: Remove liquid templates #353

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

abovedave
Copy link
Collaborator

I noticed when working on #352 that the Liquid decency is outdated and flagged in a security issue. This PR refactors the preview site templates to use a simpler approach as we're not using any of the features Liquid provides.

@giamir
Copy link
Contributor

giamir commented Oct 1, 2024

Thanks @abovedave for the PR. I am all up for simplifying but consider that we have recently introduced liquid templates for mocking Core's layout in new Free Refills services. I don't see our usage of liquid going away any time soon.

Perhaps there is another webpack loader we can use instead of removing the liquid templates all together?
Where can I read more about the vulnerabilities of that loader?

Thank you

@abovedave
Copy link
Collaborator Author

Ah I see! I could just swap out the new Function() with the actual Liquid package and skip the unmaintained loader if we really want it? It just seemed uncessary to use liquid just for a simple layout-view setup.

This was the error:

# npm audit report

liquidjs  <10.0.0
Severity: moderate
liquidjs may leak properties of a prototype - https://github.com/advisories/GHSA-45rm-2893-5f49
No fix available
node_modules/liquidjs
  liquidjs-loader  *
  Depends on vulnerable versions of liquidjs
  node_modules/liquidjs-loader

@giamir
Copy link
Contributor

giamir commented Oct 1, 2024

It just seemed uncessary to use liquid just for a simple layout-view set

@abovedave I would like to talk to Dan before removing Liquid all together from this repo. If the new Function() approach can buy us some time and fix the vulnerability I would prefer it. Thanks 🙏

Copy link

netlify bot commented Oct 1, 2024

Deploy Preview for stacks-editor ready!

Name Link
🔨 Latest commit 68c162c
🔍 Latest deploy log https://app.netlify.com/sites/stacks-editor/deploys/66fbe8db3a4930000889de51
😎 Deploy Preview https://deploy-preview-353--stacks-editor.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants