Re: User-defined templates - are they safe? Is FreeMarker a secure sandbox?

Hmmm DoS attacks are less of a concern at this point than data leakage, but
they are a concern.  If wonder if another template language would help get
around that, or if it is an unavoidable risk.
On Fri, Jan 16, 2009 at 11:41 PM, Daniel Dekany <[email protected]> wrote:

> Saturday, January 17, 2009, 1:51:37 AM, Dobes Vandermeer wrote:
>
> > Hello All,
> >
> > I'd like to use FreeMarker to allow my users to customize the
> > layout and appearance of reports and invoices.  However, I have to
> > make sure this won't negatively impact the security of my application.
> >
> > I'm wondering whether anyone has some ideas about whether rendering
> > user-defined freemarker templates would create a security hole.  For
> > example, can you access global classes, the class instance of
> > objects (to call getClass().getResourceAsStream(...)), or other data
> > outside the scope of the data passed as a parameter to freemarker?
> >
> > Has anyone done this before?  Is FreeMarker safe for this use?
>
> You can only access the stuff that the data-model exposes, except that
> with the ?new built-in the user may instantiates any class that
> implements freemarker.template.TemplateModel. Another security risk,
> if it's a client-server software, is DoS attacks, as users could write
> templates that contain practically infinite loops.
>
> > Thanks in advance,
> > Dobes
> >
>
> --
> Best regards,
>  Daniel Dekany
>
>


-- 

Dobes Vandermeer
Director, Habitsoft Inc.
[email protected]
778-891-2922

------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword

_______________________________________________
FreeMarker-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/freemarker-user