Re: Should I use freemarker?
Jeremy Chone <[email protected]>
| Newsgroups | gmane.comp.web.freemarker.user |
|---|---|
| Message-ID | <[email protected]> |
Ok, I am just a user, but here is my answer. First, yes, freemarker is a very good technology to process a data set into various text ouput. Letting the user editing directly freemarker templates might be a little bit risky. Security wise, I am not sure, but the user could have an infinite for loop or have some code that would throw exception. I think the option would be to have an alternative template, with some high level tags that would then be translated to freemarker tags. However, if your usecase is like the wordpress template editor, where the user can edit phps, then, I would say that the Freemarker path would be very similar. Jeremy, On Tue, Mar 30, 2010 at 2:25 PM, Treague, Keith < [email protected]> wrote: > I’m looking for a templating engine that can take a set of data I give > it, put it into an html template, and then I’ll either return that to a web > browser or send that out as an e-mail. The catch is I want my users to be > able to edit the template itself. > > > > My concern is if they are editing the template, is there any way they can > create a malicious template that will execute malicious code on the server > such as calling various services on the server to get unauthorized info or > grant themselves additional access? If you can execute arbitrary java > methods from a template I can’t use it. Any input I’d appreciate! > > > > (sorry if you get this twice, the first time I sent it I wasn’t subscribed > yet) > > > ------------------------------------------------------------------------------ > Download Intel® Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > FreeMarker-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/freemarker-user > > -- Jeremy Chone +1 415 699 9912 ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ FreeMarker-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/freemarker-user