Re: Constraint velocity scripts
Bradley Wagner <[email protected]> Thu, 17 Nov 2022 21:08:55 -0500
| Newsgroups | gmane.comp.jakarta.velocity.user |
|---|---|
| Message-ID | <CAEbivYWZGKtYx_Kxd37byz1YUt4e9OvKWqWDVnqAh50tZVxAjw@mail.gmail.com> |
--000000000000bdcf6f05edb53081 Content-Type: text/plain; charset="UTF-8" Yes. I believe the feature you are after is the SecureUberspecter which can be used to restrict access to various packages and the ability to arbitrary instantiate classes through reflection. https://velocity.apache.org/engine/2.3/apidocs/org/apache/velocity/util/introspection/SecureUberspector.html On Thu, Nov 17, 2022 at 7:25 PM Alex O'Ree <[email protected]> wrote: > From what i understand, velocity scripts basically allow someone to call > any valid java code or velocity tag. Is there any api or some plugin > infrastructure that exists and i could use to constrain which classes can > be called by velocity? > > For example, i want to prevent API calls to java.net.URL or perhaps > whitelist a set of classes or tags that a user can execute via velocity. is > this a thing? > -- Bradley Wagner VP Product, Hannon Hill p. 678-904-6900 x115 w. www.hannonhill.com e [email protected] --000000000000bdcf6f05edb53081--