Re: HTML whitelisting / template security

However, since you expect malevolent user here, validating the
template doesn't do much... like what if I do "<i${"frame"}>" to
conceal the usage of iframe. You had to validate the *output* of the
templates. That's again not FM's concern, but you can utilize that
it's you who give the output Writer to FM... so if that Writer hunts
down certain elements, it can throw IOException("Element not allowed")
sometimes. This however will eat some CPU in the server for sure...


Thursday, September 9, 2010, 11:27:41 AM, Daniel Dekany wrote:

> Since FreeMarker doesn't parse the static part of templates,
> FreeMarker itself doesn't provide solution for this. So it's up to you
> to check this when the user uploads the template, or if you can't do
> that (like if they upload with FTP, it's not easy to add a hook for
> this), you can write a custom TemplateLoader which just wraps any
> other TemplateLoader but checks the content. This would validate the
> template on-demand and on-the-fly (but not for all visits of the page,
> only whenever the template is not yet in the cache of FreeMarker... so
> assuming caching works OK there, you don't have to afraid about
> validator speed much).
>
>
> Thursday, September 9, 2010, 10:29:09 AM, Tobias Prinz wrote:
>
>> Hey there,
>>
>> is there any way to disable certain elements that someone might use in
>> a template before rendering? Some kind of html black/whitelisting?  
>> Filtering out Javascript?
>>
>> I just realized that it might not be smart to allow different users to
>> do uncontrolled templating on the same domain, because they might  
>> hijack domains and all those nice things.
>>
>> Sorry for writing in a hurry, for some reasons I always seem to get  
>> those ugly ideas ten minutes before a security-related meeting ;-)
>>
>> Bye,
>> Tobias
>>
>> ------------------------------------------------------------------------------
>> This SF.net Dev2Dev email is sponsored by:
>>
>> Show off your parallel programming skills.
>> Enter the Intel(R) Threading Challenge 2010.
>> http://p.sf.net/sfu/intel-thread-sfd
>> _______________________________________________
>> FreeMarker-user mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/freemarker-user
>>
>

-- 
Best regards,
 Daniel Dekany


------------------------------------------------------------------------------
This SF.net Dev2Dev email is sponsored by:

Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd