42 lines
1.8 KiB
Diff
42 lines
1.8 KiB
Diff
From cf85e450636afbe0408354ff04a4018659e64955 Mon Sep 17 00:00:00 2001
|
|
From: Will Glass-Husain <wglass@forio.com>
|
|
Date: Thu, 16 Jul 2020 22:31:22 -0700
|
|
Subject: [PATCH] update list of restricted classes
|
|
|
|
---
|
|
.../velocity/runtime/defaults/velocity.properties | 11 ++++++++++-
|
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/java/org/apache/velocity/runtime/defaults/velocity.properties b/src/java/org/apache/velocity/runtime/defaults/velocity.properties
|
|
index 504cbcc..fd1063a 100644
|
|
--- a/src/java/org/apache/velocity/runtime/defaults/velocity.properties
|
|
+++ b/src/java/org/apache/velocity/runtime/defaults/velocity.properties
|
|
@@ -245,9 +245,13 @@ runtime.introspector.uberspect = org.apache.velocity.util.introspection.Uberspec
|
|
# accessed.
|
|
# ----------------------------------------------------------------------------
|
|
|
|
+# Prohibit reflection
|
|
introspector.restrict.packages = java.lang.reflect
|
|
|
|
-## ClassLoader, Thread, and subclasses disabled by default in SecureIntrospectorImpl
|
|
+# ClassLoader, Thread, and subclasses disabled by default in SecureIntrospectorImpl
|
|
+
|
|
+# Restrict these system classes. Note that anything in this list is matched exactly.
|
|
+# (Subclasses must be explicitly named to be included).
|
|
|
|
introspector.restrict.classes = java.lang.Class
|
|
introspector.restrict.classes = java.lang.Compiler
|
|
@@ -261,4 +265,9 @@ introspector.restrict.classes = java.lang.System
|
|
introspector.restrict.classes = java.lang.ThreadGroup
|
|
introspector.restrict.classes = java.lang.ThreadLocal
|
|
|
|
+# Restrict instance managers for common servlet containers (Tomcat, JBoss, Jetty)
|
|
+
|
|
+introspector.restrict.classes = org.apache.catalina.core.DefaultInstanceManager
|
|
+introspector.restrict.classes = org.wildfly.extension.undertow.deployment.UndertowJSPInstanceManager
|
|
+introspector.restrict.classes = org.eclipse.jetty.util.DecoratedObjectFactory
|
|
|
|
--
|
|
2.23.0
|
|
|