Re: Freemarker Sandboxing
Attila Szegedi <[email protected]>
| Newsgroups | gmane.comp.web.freemarker.user |
|---|---|
| Message-ID | <[email protected]> |
On 2008.06.16., at 19:53, Daniel Dekany wrote: >>> or >>> create arbitrary objects. >> >> It does have a ?new built-in, but it can only create objects that >> implement the TemplateModel interface. > > (With the same logic as above, this also up to the Web Application > Framework.) Well, yes, theoretically if the webapp contains some special purpose class that also implements TemplateModel (i.e. custom methods), this could be exploited. However, combined with Java security policy that disallows access to classes in implementation-specific packages, it can be mitigated. Or simply by making these classes package-private; ? new built-in can only instantiate public classes. Also, since you can't isolate memory usage of different users within the same JVM, someone can craft a webpage that concatenates a sequence in an infinite loop, eventually causing OutOfMemoryError on other threads, or just increasing memory pressure on the server to ruin its performance. That's one thing you can't guard against... Attila. ------------------------------------------------------------------------- Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://sourceforge.net/services/buy/index.php