[Teamplates][Razor] Support Razor based templates via `RazorLight`

[xperiandri]

Is your feature request related to a problem? Please describe.

It would be very nice to be able to write markup inside the admin panel not only using Liquid but also Razor

Describe the solution you'd like

Add ability to write templates using Razor by including https://github.com/toddams/RazorLight and adding a switch in the template to switch the template language

Describe alternatives you've considered

Do not use Templates but hard code pages via compiled Razor

[hishamco]

It's a good idea to provide an option to either add Liquid or Razor templates from within the admin. May be it's by design while the Razor need compilation. @sebastienros is there a reason that we don't provide such option?

[jtkech]

Security issue as everything can be done through razor

[Skrypt]

That's RazorLight so I'm assuming that it removes access to "@using" a lot of security sensible assemblies? Need to understand what RazorLight is about if not.

[sebastienros]

typeof(Type).GetType("EvilType").GetMethod("EvilMethod").Invoke()

[Skrypt]

Reflection is evil 😄

[ns8482e]

@sebastienros can build oczor for razor syntax 😊

[ns8482e]

@xperiandri I’d say if you prefer to use razor syntax then use it during build time for modules and themes

And use liquid for light weight rendering for non authoring user

[hishamco]

Lol, I'm not with using RazorLight ;) provide an elegent way to create Razor templates like Liquid

[deanmarcussen]

What @sebastienros is trying to say is that liquid is a safe language to edit in a cms because it’s designed to be safe.

razor or razor light is not (I’ve used it, it’s good but unsafe), so you could have users doing all sorts of things, like method invokes, or stackoverflows from infinite recursion, which can bring the site to a grinding halt

[hishamco]

Agree, but could be useful during development

[sebastienros]

@ns8482e well, would not be very hard to build something like razor that is as safe as liquid and uses most of C# syntax. There would be limits for sure, but the overall experience could be here, meaning @ and c# syntax.

[hishamco]

Agree, but could be useful during development

[ns8482e]

@hishamco for development I feel watch and hot reload works well, but slow than liquid

[hishamco]

Right, but for C# developer creating .cshtml templates may easier for them because they already use ASP.NET Core & Razor. It's matter of choice

[Skrypt]

Liquid is super fast, I don't know where is the issue. Learning Liquid? You can always use a custom module and build your own Razor precompiled templates. And I think we agreed on, a while back, to not reintroduce runtime compilation in OC.

[hishamco]

The problem is not with Liquid, but why we didn't offer Razor templates while we already can create layouts and views in modules using Razor

[Skrypt]

Because from RUNTIME it's not safe to allow to use System.IO for example. And Razor doesn't prevent anyone from doing this, which leads to security issues.

[hishamco]

I think that means we enforce everyone to use Liquid to do templating