What commands specifically? The potential trouble I can see is you not escaping special characters in the JSON. The default way to overcome this limitation is to convert the thing you want escaped to base64, but you will get about a 33% overhead in payload size.

If you read the documentation of binary_to_term, then you can notice that you can use the safe option to avoid creation of new atoms, by default it should work with everything. At the same time this option you are mentioning doesn’t make much sense, as you are literally dealing with a big string that is your template, not with a data structure, if you are asking wether using term_to_binary instead of json is better, then kinda, you get the smaller payload at the price of more incovinient debugging.

Needlessly to say, there are various dangers involved with what you are trying to do. If your eex templates are not created by a trusted party, then you are in for a not fun time, as there is no concept of sandboxing around eex templates, you are better off with using something like luerl if the potential executed templates are unsafe.

Yep, Base64 is pretty bullet-proof in terms of putting “any kind of thing” into JSON.

It doesn’t matter in what format you save the file. Once you do something like EEx.eval_string, you will be executing code from the context of your VM, having the exact same access level as the code you have in your codebase. For example I could send you a template with the following:

<%= Ecto.Adapters.SQL.query(MyRepo, "DROP SCHEMA public CASCADE;") %>

This thing will drop all the tables in your current database, no warnings, assuming I know your repo module, but that can be determined fairly trivial.

Looking at the examples you provided though, it seems that you want to use eex templates to generate local vedored components. This is a nice idea, but the execution is a bit strange, I would personally define those components as .ex files and use something like igniter for the actual mix task, as you have a lot of source code in those templates and it is pretty hard to read and maintain them. Using this method also overcomes all dangers with getting unsafe templates, as igniter operates on AST, it is not actually executing code.

I understand the challenge, the thing I wondered is if you could actually use igniter (or maybe something like sorceror), to manipulate an existing component that is an .ex file to configure how you want it, without actually running any code.

I’ve never used them before, so I have no idea how a implementation would look like, but you should be able to do the following:

fetch .ex file that is your component → use sourceror + some kind of convention that you define for attributes to manipulate the AST (for example credo uses comments in a special format) based on your user’s needs → generate the local .ex file with the actual modifications you required.

I realize that this is substantially more complex than the current approach you are using and I can totally understand why the template way is more preferred.