Re: User-defined templates - are they safe? Is FreeMarker a secure sandbox?

Saturday, January 17, 2009, 1:51:37 AM, Dobes Vandermeer wrote:

> Hello All,
>
> I'd like to use FreeMarker to allow my users to customize the
> layout and appearance of reports and invoices.  However, I have to
> make sure this won't negatively impact the security of my application.
>
> I'm wondering whether anyone has some ideas about whether rendering
> user-defined freemarker templates would create a security hole.  For
> example, can you access global classes, the class instance of
> objects (to call getClass().getResourceAsStream(...)), or other data
> outside the scope of the data passed as a parameter to freemarker?
>
> Has anyone done this before?  Is FreeMarker safe for this use?

You can only access the stuff that the data-model exposes, except that
with the ?new built-in the user may instantiates any class that
implements freemarker.template.TemplateModel. Another security risk,
if it's a client-server software, is DoS attacks, as users could write
templates that contain practically infinite loops.

> Thanks in advance,
> Dobes
>

-- 
Best regards,
 Daniel Dekany


------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword