Fixed Liquid provider to sanitize HTML content

bkuhlmann · bkuhlmann · commit 679625f6006e · 2026-04-14T11:22:50.000-06:00
Ensures rendering of Liquid templates are sanitized before final output is generated. This also improves consistency across the application (especially when rendering screens for devices (which has had this capability for a while).

Milestone: patch
diff --git a/config/providers/liquid.rb b/config/providers/liquid.rb
@@ -7,7 +7,7 @@
     default = TRMNL::Liquid.new { |environment| environment.error_mode = :strict }
 
     renderer = lambda do |template, data, environment: default|
-      Liquid::Template.parse(template, environment:).render data
+      slice["aspects.sanitizer"].call Liquid::Template.parse(template, environment:).render(data)
     end
 
     register :default, renderer
diff --git a/spec/app/aspects/extensions/renderers/image_spec.rb b/spec/app/aspects/extensions/renderers/image_spec.rb
@@ -20,7 +20,9 @@
     it "renders template with single URI" do
       expect(renderer.call(extension, context:)).to be_success(
         Terminus::Aspects::Extensions::Capsule[
-          content: %(<img src="https://test.io/test.png" alt="Image">)
+          content: <<~CONTENT.strip
+            <html><head></head><body><img src="https://test.io/test.png" alt="Image"></body></html>
+          CONTENT
         ]
       )
     end
@@ -35,9 +37,10 @@
 
       expect(renderer.call(extension, context:)).to be_success(
         Terminus::Aspects::Extensions::Capsule[
-          content: <<~CONTENT
-            <img src="https://test.io/one.png" alt="Image">
+          content: <<~CONTENT.strip
+            <html><head></head><body><img src="https://test.io/one.png" alt="Image">
             <img src="https://test.io/two.png" alt="Image">
+            </body></html>
           CONTENT
         ]
       )
diff --git a/spec/app/aspects/extensions/renderers/poll_spec.rb b/spec/app/aspects/extensions/renderers/poll_spec.rb
@@ -42,7 +42,13 @@
 
       expect(renderer.call(extension, context:)).to be_success(
         Terminus::Aspects::Extensions::Capsule[
-          content: %(<h1>Test Label</h1>\n\n  <p>Test: A test.</p>\n\n)
+          content: <<~CONTENT.strip
+            <html><head></head><body><h1>Test Label</h1>
+
+              <p>Test: A test.</p>
+
+            </body></html>
+          CONTENT
         ]
       )
     end
@@ -67,11 +73,12 @@
       end
 
       it "answers render template and captures errors" do
-        html = <<~CONTENT
-          <h1>Test Label</h1>
+        html = <<~CONTENT.strip
+          <html><head></head><body><h1>Test Label</h1>
           <p>Test</p>
 
           <p>Test</p>
+          </body></html>
         CONTENT
 
         expect(renderer.call(extension, context:)).to be_failure(
diff --git a/spec/app/aspects/extensions/renderers/static_spec.rb b/spec/app/aspects/extensions/renderers/static_spec.rb
@@ -30,7 +30,15 @@
 
       expect(renderer.call(extension, context:)).to be_success(
         Terminus::Aspects::Extensions::Capsule[
-          content: %(<h1>Days</h1>\n\n  <p>One</p>\n\n  <p>Two</p>\n\n)
+          content: <<~CONTENT.strip
+            <html><head></head><body><h1>Days</h1>
+
+              <p>One</p>
+
+              <p>Two</p>
+
+            </body></html>
+          CONTENT
         ]
       )
     end

Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,9 @@`
`20`	`20`	`it "renders template with single URI" do`
`21`	`21`	`expect(renderer.call(extension, context:)).to be_success(`
`22`	`22`	`Terminus::Aspects::Extensions::Capsule[`
`23`		`- content: %(<img src="https://test.io/test.png" alt="Image">)`
	`23`	`+ content: <<~CONTENT.strip`
	`24`	`+ <html><head></head><body><img src="https://test.io/test.png" alt="Image"></body></html>`
	`25`	`+ CONTENT`
`24`	`26`	`]`
`25`	`27`	`)`
`26`	`28`	`end`
`@@ -35,9 +37,10 @@`
`35`	`37`
`36`	`38`	`expect(renderer.call(extension, context:)).to be_success(`
`37`	`39`	`Terminus::Aspects::Extensions::Capsule[`
`38`		`- content: <<~CONTENT`
`39`		`- <img src="https://test.io/one.png" alt="Image">`
	`40`	`+ content: <<~CONTENT.strip`
	`41`	`+ <html><head></head><body><img src="https://test.io/one.png" alt="Image">`
`40`	`42`	`<img src="https://test.io/two.png" alt="Image">`
	`43`	`+ </body></html>`
`41`	`44`	`CONTENT`
`42`	`45`	`]`
`43`	`46`	`)`