Re: Include acquisition

Great! Thanks for the info. I should look more into template loading. 

-- Denis.

On 29 Jun 2011, at 23:45, Daniel Dekany <[email protected]> wrote:

> Wednesday, June 29, 2011, 11:55:24 PM, Denis Bredelet wrote:
> 
>> 
>> Daniel Dekany wrote:
>> 
>>> Wednesday, June 29, 2011, 1:13:28 PM, Denis Bredelet wrote:
>>> 
>>>> 
>>>> Daniel Dekany wrote:
>>>> 
>>>> 
>>>> You also know this feature?
>>>> http://freemarker.org/docs/ref_directive_include.html#ref_directive_include_acquisition
>>>> 
>>>> I didn't know about this feature. It is cool, but how do you make
>>>> sure templates are not loaded from a wrong place?
>>> 
>>> What exactly do you mean? The "*" is only replaced with the current
>>> directory, and then by its parent directories, until the template is
>>> found. So it's not like it searches the template everywhere.
>> 
>> What I mean is that I have things that have nothing to do with
>> Freemarker at the root of the drive. If a template is missing, I am
>> afraid this feature could load malicious content inadvertently.
> 
> FreeMarker templates doesn't work with real paths; they are stuck
> inside the virtual file-system implemented by the TemplateLoader. Like
> if you setup FreeMarker with
> cfg.setDirectoryForTemplateLoading("/foo/bar/templates"), then when a
> template says "/" it's translated to "/foo/bar/templates" by the
> TemplateLoader. If the template says "/../../../etc/passwd", that's an
> error as you can't leave the virtual root. It's like chroot cage. Of
> course, acquisition also has to stop at the virtual root.
> 
>>>> Eg. <#include "*/tmp/quickfix.ftl">
>>>> 
>>>> Is there a configuration setting that tells Freemarker /tmp is
>>>> off-limits?
>>> 
>>> No, but you have included "tmp" in the path above, so then why would
>>> you want to exclude "tmp"?
>> 
>> I want to exclude /tmp because that directory is typically world-writable.
> 
> So, because of what I said above, there's no such danger. Or if there
> is, then that was there regardless of acquisition.
> 
>> -- Denis.
>> 
>>> 
>>>> A way to tell the minimum length or minimum prefix of the wildcard part.
>>> 
>>> Nope.
>>> 
>>> (FM acquisition do have a problems though... If template A includes
>>> template */B, and then template B includes */C, the searching of C
>>> starts from the (real) directory of B, not from the directory of A.
>>> Some may thinks that's all right, but it's just not how acquisition
>>> meant to work.)
>>> 
>>>> Cheers
>>>> -- Denis. 
>>> 
>>> -- 
>>> Best regards,
>>> Daniel Dekany
> 
> -- 
> Best regards,
> Daniel Dekany
> 
> 
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security 
> threats, fraudulent activity, and more. Splunk takes this data and makes 
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> FreeMarker-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/freemarker-devel

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2