# Force ERB templates to prevent making changes to models?

**URL:** <https://www.ruby-forum.com/t/force-erb-templates-to-prevent-making-changes-to-models/152652>\
**Category:** Rails\
**Created:** [November 6, 2008, 1:48am UTC](https://www.ruby-forum.com/t/force-erb-templates-to-prevent-making-changes-to-models/152652 "2008-11-06T01:48:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [November 6, 2008, 1:48am UTC](https://www.ruby-forum.com/t/force-erb-templates-to-prevent-making-changes-to-models/152652/1 "2008-11-06T01:48:15Z")

</div>

I want to build a system where I can let users write templates that  
allow read access to Rails objects within and then send these templates  
out to customers via email. The problem I’m having is that through my  
tests, it’s become obvious that this can create a security risk.

Example: A customer could put text into their template such as:

@customers = Customer.find(:all)  
@customers.each do |c|  
c.destroy  
end

inside the ERB template and when I call it to render the results like  
this:

# Render Template

@text = ERB.new(lbt.body\_content).result(binding)

It will execute the above command and erase all the customers from the  
database.

All I really want people to be able to do is parse variables I hand into  
the template, not actually load Rails objects and make changes. That  
way I can specify and pre-populate what they have access to and plug  
that security issue.

Does any one know the best way to do this? I’m assuming there are other  
ERB command I can use to render, but I can’t seem to find it.

Thanks

- Jesse

---

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [November 6, 2008, 11:25am UTC](https://www.ruby-forum.com/t/force-erb-templates-to-prevent-making-changes-to-models/152652/2 "2008-11-06T11:25:16Z")

</div>

On 6 Nov 2008, at 00:48, Jesse P. wrote:

> I want to build a system where I can let users write templates that  
> allow read access to Rails objects within and then send these  
> templates  
> out to customers via email. The problem I’m having is that through my  
> tests, it’s become obvious that this can create a security risk.

Have a look at liquid templates ([http://www.liquidmarkup.org/](http://www.liquidmarkup.org/)) , they  
were designed with that in mind.

Fred