Re: Freemarker and security
Attila Szegedi <[email protected]>
| Newsgroups | gmane.comp.web.freemarker.user |
|---|---|
| Message-ID | <[email protected]> |
For the 3.0 codebase, I actually implemented a way to subject FreeMarker templates to Java security policy. See <http://freemarker.sourceforge.net/docs-24pre1/pgui_misc_secureenv.html> for the description, under the "Running Templates in their own security domain" section. It's implemented and it works; if there's interest, we could backport this to 2.4 codebase. Attila. On Dec 8, 2010, at 7:47 PM, Chris wrote: > We're building an app where untrusted users will be able to create their > own templates. This is a website where users will be able to create > their own websites in a shared environment. The different sites will > share a JVM. > > What are the security risks? > > I looked through the Freemarker template language and did not find much > of concern, though I'm a bit leery of the ways that users might be able > to invoke Java code. > > Can anyone point to specific risks or holes we need to look out for? > > Any advice on how to lock it down so users won't be able to do any > damage outside the context of their own template? > > > ------------------------------------------------------------------------------ > This SF Dev2Dev email is sponsored by: > > WikiLeaks The End of the Free Internet > http://p.sf.net/sfu/therealnews-com > _______________________________________________ > FreeMarker-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/freemarker-user ------------------------------------------------------------------------------