Re: Freemarker and security

>>  It's just too big, and wasn't designed for that.
>>
>
> Understood. I wonder if it would be possible to implement a subset of
> Freemarker functionality, maybe by forking the Freemarker code?
>
> Allowed:
> Referencing data models using ${}
> A limited number of directives:<#if>,<#list>,<#assign>
> A few built-ins: ?substring()
> Macros
> Includes, with control over paths
>
> Disallowed:
> Everything else
>
> Is there a parser class somewhere that could be modified so that other
> kinds of constructs simply aren't recognized?
>

I found FMParser.jj. It's big and complicated, but not completely 
impenetrable.

I wonder if you could get away with commenting out many of the clauses 
in the TOKEN definition, and then regenerating the parser?

You could then subclass Template and override the main public 
constructor to use the new parser.

Or would it be better to use the existing parser, but then walk through 
the parse tree and modify the dangerous nodes?


------------------------------------------------------------------------------