User-defined templates - are they safe? Is FreeMarker a secure sandbox?
"Dobes Vandermeer" <[email protected]>
| Newsgroups | gmane.comp.web.freemarker.user |
|---|---|
| Message-ID | <[email protected]> |
Hello All, I'd like to use FreeMarker to allow my users to customize the layout and appearance of reports and invoices. However, I have to make sure this won't negatively impact the security of my application. I'm wondering whether anyone has some ideas about whether rendering user-defined freemarker templates would create a security hole. For example, can you access global classes, the class instance of objects (to call getClass().getResourceAsStream(...)), or other data outside the scope of the data passed as a parameter to freemarker? Has anyone done this before? Is FreeMarker safe for this use? Thanks in advance, Dobes ------------------------------------------------------------------------------ This SF.net email is sponsored by: SourcForge Community SourceForge wants to tell your story. http://p.sf.net/sfu/sf-spreadtheword _______________________________________________ FreeMarker-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/freemarker-user