Re: Freemarker and security

> That's also a possibility, but instead of modifying the tree you
> should throw an exception saying that this-and-that is not allowed for
> security reasons. Most certainly you should do this check where
> FreeMarker just finished building the AST (so it can't be
> circumvented, accidently or otherwise), so you will have to modifying
> the source code. If you think you find a solution that could be
> integrated into the official FreeMarker (like adding a callback here
> and there), tell us. That would be much better than forking for
> everyone.
>
> Note that contributing require you to sign and post a CLA. However, if
> you careful not to post any actual source code, but point out where
> should I add and what kind of callback... then I could do that, and
> you don't have to wait for 2.3.17, as you could use a nightly build,
> then switch to 2.3.17 whenever it's released.
>

I'll work on this. I'm thinking some kind of security filter that you 
set in the template loader. You could arbitrarily allow or disallow 
certain constructs.

I've no problem signing a contributor agreement if you want to post it 
somewhere.


------------------------------------------------------------------------------
Oracle to DB2 Conversion Guide: Learn learn about native support for PL/SQL,
new data types, scalar functions, improved concurrency, built-in packages, 
OCI, SQL*Plus, data movement tools, best practices and more.
http://p.sf.net/sfu/oracle-sfdev2dev