Freemarker and security
Chris <[email protected]>
| Newsgroups | gmane.comp.web.freemarker.user |
|---|---|
| Message-ID | <[email protected]> |
We're building an app where untrusted users will be able to create their own templates. This is a website where users will be able to create their own websites in a shared environment. The different sites will share a JVM. What are the security risks? I looked through the Freemarker template language and did not find much of concern, though I'm a bit leery of the ways that users might be able to invoke Java code. Can anyone point to specific risks or holes we need to look out for? Any advice on how to lock it down so users won't be able to do any damage outside the context of their own template? ------------------------------------------------------------------------------ This SF Dev2Dev email is sponsored by: WikiLeaks The End of the Free Internet http://p.sf.net/sfu/therealnews-com