freemarker
freemarker copied to clipboard
Disable execution for freemarker.template.utility.Execute
This class can be used as a gadget for attack. It is suggested to make a setting to disable potentially dangerous code
Creating an instance of this TemplateModel from templates is disabled by default already (see TemplateClassResolver.SAFER_RESOLVER). So I'm note sure how much this helps in practice, as this doesn't block by default, and people had to realize that the problem exist at all, and then that there's a system property to block it.