freemarker icon indicating copy to clipboard operation
freemarker copied to clipboard

Disable execution for freemarker.template.utility.Execute

Open setuper opened this issue 9 months ago • 1 comments

This class can be used as a gadget for attack. It is suggested to make a setting to disable potentially dangerous code

setuper avatar Apr 02 '25 14:04 setuper

Creating an instance of this TemplateModel from templates is disabled by default already (see TemplateClassResolver.SAFER_RESOLVER). So I'm note sure how much this helps in practice, as this doesn't block by default, and people had to realize that the problem exist at all, and then that there's a system property to block it.

ddekany avatar Apr 04 '25 19:04 ddekany