Hmmm - granted, some data needs to be determined ahead of time. But, to answer your questions:

• CODE references which are being interpolated into a string should be considered callbacks 100% of the time. If you want to actually put in "CODE(0x1234578)", stringify the coderef first. Perhaps in other contexts, having a code ref is more questionable (say, serialisation), but I am having a hard time figuring on when passing in a code ref is going to be anything other than a callback. The callback may not be immediate - it may just be stored for future use (e.g., in Tk), but it will be called back iff the situation arises, which is no different than this - if there is no variable in the template, the callback doesn't get called.
• In Re: String expansion script, I had a callback which could return a list. Perhaps you want to give your users an API to fill that says all returns are scalars - lists and hashes aren't supported. Perhaps they're scalars, but lists must be returned as array refs, and hashes as hash refs. Whatever it is, I do think that this is something that we, as a community, should try, then iron out. Like many other idioms, which sprang to existance from trial and error, I think we could end up with a very flexible and clean interface here. Heck - it could be based on XPath! :-)
• If a callback dies? What happens if a hash sets a value to undef? The callback can return undef, too, I suppose, so it's not quite the same. I would think it completely reasonable to expect the callback to catch all exceptions and deal with them, or, if the callback propogates the exception (that is, doesn't use eval), it would be completely reasonable for the template to propogate it as well. Which is not significantly different from operations today.
• Allow parameters? Hey, that's cool. But let's take it one step at a time, ok? :->
• Eval from within the template? I'm not talking about allowing the template author to embed perl in the template (there are template managers for that already). I'm talking about straight variable substitution. If the developer who is using the template manager is concerned about safety, and doesn't think that the callback is safe, don't use it. I can't see how that would be the case - all the safety would be inside the callback. The developer then gets to tell the HTML author(s) what tags are allowed, and what they do. If the template code allows for parameters, but the callback doesn't, then the perl developer won't tell the HTML authors about parameters. If parameters are allowed, it's up to the callback to ensure the safety. If the perl developer allows a variable substitution of eval("system(q(rm -rf /))"), that is not the template manager making things unsafe - that's the callback developer making things unsafe. Treating the variables as tainted is almost as recommended here as it is for dealing with end-user text from a web form. I would hope that the html template authors would be on the same team as the perl developer, though ;-)

Problems aren't often simple - but their solutions often are ;-)

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.