Re: Freemarker Sandboxing

Monday, June 16, 2008, 5:42:30 PM, Attila Szegedi wrote:

> On 2008.06.16., at 17:20, Alan Gutierrez wrote:
>
>> I'm developing a Web 2.0 application and I'd like to give people the
>> ability to upload templates for particular web pages. Blogspot
>> provides this sort of customization. It uses a special XML template
>> language.
>>
>> I'd like to use Freemarker. I've not looked at it thoroughly, but it
>> appears to only permit you to use objects that have been exposed to
>> it's context.
>>
>> I'm wondering if Freemarker can call arbitrary static functions
>
> No.

However, if you expose the proper "tool" in the data-model, then it
can. I would say, stuff like this is up to the Web Application
Framework.

>> or
>> create arbitrary objects.
>
> It does have a ?new built-in, but it can only create objects that  
> implement the TemplateModel interface.

(With the same logic as above, this also up to the Web Application
Framework.)

>> Or maybe, has anyone tried to run Freemarker in a sandbox?
>
> At least in 2.4 (and I might end up backporting this to 2.3 if there's
> a need) most stock template loaders assign a java.security.CodeSource
> to templates and make sure templates are run with Java security  
> permissions for that particular code source, so you should be able to
> control them using the standard implementation of Java security policy
> by running the JVM with a security manager.
>
> Attila.
>
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> FreeMarker-user mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/freemarker-user

-- 
Best regards,
 Daniel Dekany


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php