I would like to know if it is safe to use EJS in a Node Express web server, to let users create customizable content, that would be then rendered server side by EJS (https://www.npmjs.com/package/ejs).

For instance, a user could create a template where he would specify {%= product.category %} in a product description webpage.

But then, he could specify {%= process.exit(0) %} which would cause the web server to exit! He could also get access to the server file system, I guess.

One way to add some security would be to specify { process: null } in the context parameter of the render method, but I imagine there are many other dangerous entries?

So is it safe to do this? Are there some workarounds (maybe some EJS options, but I did not see them)? Or some alternative packages?

Edit: I have found the following issue on the package repository: https://github.com/mde/ejs/issues/632 which recommends not using EJS for such a use case.