Re: Freemarker and security
Ken Egervari <[email protected]>
| Newsgroups | gmane.comp.web.freemarker.user |
|---|---|
| Message-ID | <[email protected]> |
Freemarker is the last place you should be concerned with. With freemarker, it will only have access to your model objects that you provide it. So if your model objects are secure, then so is freemarker. If you don't trust users to access your model objects, then that's another problem altogether. Ken On Wed, Dec 8, 2010 at 10:47 PM, Chris <[email protected]> wrote: > We're building an app where untrusted users will be able to create their > own templates. This is a website where users will be able to create > their own websites in a shared environment. The different sites will > share a JVM. > > What are the security risks? > > I looked through the Freemarker template language and did not find much > of concern, though I'm a bit leery of the ways that users might be able > to invoke Java code. > > Can anyone point to specific risks or holes we need to look out for? > > Any advice on how to lock it down so users won't be able to do any > damage outside the context of their own template? > > > > ------------------------------------------------------------------------------ > This SF Dev2Dev email is sponsored by: > > WikiLeaks The End of the Free Internet > http://p.sf.net/sfu/therealnews-com > _______________________________________________ > FreeMarker-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/freemarker-user > ------------------------------------------------------------------------------ This SF Dev2Dev email is sponsored by: WikiLeaks The End of the Free Internet http://p.sf.net/sfu/therealnews-com _______________________________________________ FreeMarker-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/freemarker-user