1 package org.apache.velocity.util.introspection; 2 3 /* 4 * Licensed to the Apache Software Foundation (ASF) under one 5 * or more contributor license agreements. See the NOTICE file 6 * distributed with this work for additional information 7 * regarding copyright ownership. The ASF licenses this file 8 * to you under the Apache License, Version 2.0 (the 9 * "License"); you may not use this file except in compliance 10 * with the License. You may obtain a copy of the License at 11 * 12 * http://www.apache.org/licenses/LICENSE-2.0 13 * 14 * Unless required by applicable law or agreed to in writing, 15 * software distributed under the License is distributed on an 16 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 17 * KIND, either express or implied. See the License for the 18 * specific language governing permissions and limitations 19 * under the License. 20 */ 21 22 import org.apache.velocity.runtime.RuntimeConstants; 23 24 import java.util.Iterator; 25 26 /** 27 * Use a custom introspector that prevents classloader related method 28 * calls. Use this introspector for situations in which template 29 * writers are numerous or untrusted. Specifically, this introspector 30 * prevents creation of arbitrary objects or reflection on objects. 31 * 32 * <p>To use this introspector, set the following property: 33 * <pre> 34 * introspector.uberspect.class = org.apache.velocity.util.introspection.SecureUberspector 35 * </pre> 36 * 37 * @author <a href="mailto:wglass@forio.com">Will Glass-Husain</a> 38 * @version $Id$ 39 * @since 1.5 40 */ 41 public class SecureUberspector extends UberspectImpl 42 { 43 /** 44 * init - generates the Introspector. As the setup code 45 * makes sure that the log gets set before this is called, 46 * we can initialize the Introspector using the log object. 47 */ 48 @Override init()49 public void init() 50 { 51 String [] badPackages = rsvc.getConfiguration() 52 .getStringArray(RuntimeConstants.INTROSPECTOR_RESTRICT_PACKAGES); 53 54 String [] badClasses = rsvc.getConfiguration() 55 .getStringArray(RuntimeConstants.INTROSPECTOR_RESTRICT_CLASSES); 56 57 introspector = new SecureIntrospectorImpl(badClasses, badPackages, log); 58 } 59 60 /** 61 * Get an iterator from the given object. Since the superclass method 62 * this secure version checks for execute permission. 63 * 64 * @param obj object to iterate over 65 * @param i line, column, template info 66 * @return Iterator for object 67 */ 68 @Override getIterator(Object obj, Info i)69 public Iterator getIterator(Object obj, Info i) 70 { 71 if (obj != null) 72 { 73 SecureIntrospectorControl sic = (SecureIntrospectorControl)introspector; 74 if (sic.checkObjectExecutePermission(obj.getClass(), null)) 75 { 76 return super.getIterator(obj, i); 77 } 78 else 79 { 80 log.warn("Cannot retrieve iterator from {} due to security restrictions.", obj.getClass().getName()); 81 } 82 } 83 return null; 84 } 85 } 86