Re: Freemarker and security

Thursday, December 9, 2010, 8:35:15 PM, Chris wrote:

>>>  It's just too big, and wasn't designed for that.
>>>
>>
>> Understood. I wonder if it would be possible to implement a subset of
>> Freemarker functionality, maybe by forking the Freemarker code?
>>
>> Allowed:
>> Referencing data models using ${}
>> A limited number of directives:<#if>,<#list>,<#assign>
>> A few built-ins: ?substring()
>> Macros
>> Includes, with control over paths
>>
>> Disallowed:
>> Everything else
>>
>> Is there a parser class somewhere that could be modified so that other
>> kinds of constructs simply aren't recognized?
>>
>
> I found FMParser.jj. It's big and complicated, but not completely 
> impenetrable.
>
> I wonder if you could get away with commenting out many of the clauses
> in the TOKEN definition, and then regenerating the parser?

Regarding this I don't know more than you. I barely did any coding in
this project, let alone touching the parser. Parsing is the expertise
of Jonathan; maybe he will answer.

> You could then subclass Template and override the main public 
> constructor to use the new parser.

FreeMarker does Template objects itself (mostly...), so how could you
force your Template subclass on it?

> Or would it be better to use the existing parser, but then walk through
> the parse tree and modify the dangerous nodes?

That's also a possibility, but instead of modifying the tree you
should throw an exception saying that this-and-that is not allowed for
security reasons. Most certainly you should do this check where
FreeMarker just finished building the AST (so it can't be
circumvented, accidently or otherwise), so you will have to modifying
the source code. If you think you find a solution that could be
integrated into the official FreeMarker (like adding a callback here
and there), tell us. That would be much better than forking for
everyone.

Note that contributing require you to sign and post a CLA. However, if
you careful not to post any actual source code, but point out where
should I add and what kind of callback... then I could do that, and
you don't have to wait for 2.3.17, as you could use a nightly build,
then switch to 2.3.17 whenever it's released.

-- 
Best regards,
 Daniel Dekany


------------------------------------------------------------------------------