Re: Freemarker and security

Thursday, December 9, 2010, 5:02:54 AM, Ken Egervari wrote:

> Freemarker is the last place you should be concerned with. With
> freemarker, it will only have access to your model objects that you
> provide it. So if your model objects are secure, then so is freemarker.

But only in principle... which is not good enough. (See other answer.)

> If you don't trust users to access your model objects, then that's another problem altogether.
>
> Ken
>
>
> On Wed, Dec 8, 2010 at 10:47 PM, Chris <[email protected]> wrote:
> We're building an app where untrusted users will be able to create their
> own templates. This is a website where users will be able to create
> their own websites in a shared environment. The different sites will
> share a JVM.
>
> What are the security risks?
>
> I looked through the Freemarker template language and did not find much
> of concern, though I'm a bit leery of the ways that users might be able
> to invoke Java code.
>
> Can anyone point to specific risks or holes we need to look out for?
>
> Any advice on how to lock it down so users won't be able to do any
> damage outside the context of their own template?
>
>
> ------------------------------------------------------------------------------
> This SF Dev2Dev email is sponsored by:
>
> WikiLeaks The End of the Free Internet
> http://p.sf.net/sfu/therealnews-com
> _______________________________________________
> FreeMarker-user mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/freemarker-user

-- 
Best regards,
 Daniel Dekany


------------------------------------------------------------------------------
This SF Dev2Dev email is sponsored by:

WikiLeaks The End of the Free Internet
http://p.sf.net/sfu/therealnews-com