Re: freemarker and end user editable templates

Saturday, June 26, 2010, 4:20:37 AM, S Ahmed wrote:

> Say I had a user editable administration page where users can edit their own templates.
>
> Can I use freemarker and be assurated that the template will only
> output what I explicitly pass to the template? (using java spring web application).

I would say, no, if you consider hackers. While hopefully it's
difficult to find exploits that expose data that should be
unaccessible, FreeMarker is still not designed to withstand malicious
template authors. With other words templates are part of the
source-code like .java files are, so unless you can use some kind of
sand-boxing or Java security for this...

What are the dangers? For one, we have the ?new operator. Surely it
only allows you to instantiate classes that implement TemplateModel,
but maybe you can't control strictly enough what such classes are in
your class-path, and can't investigate all of them for exploits. Then,
users can easily create templates to perform DoS attacks, as it's easy
to write a template with an infinite loop in it, and even combining
that with something that eats up RAM. Lastly, it's one thing what you
put into the data-model, and another thing what can be achieved
through those objects (like by calling their public methods, then the
public methods of what it returned, and so on...). This last issue can
be mitigated with properly restricting ObjectWrappers.

-- 
Best regards,
 Daniel Dekany


------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first