snoopdave opened a new pull request, #172:
URL: https://github.com/apache/roller/pull/172
Weblog template rendering currently loads resources from the application
classpath in addition to the theme namespace. This change confines template
resource resolution to the active theme and restricts include targets to the
shapes a template actually takes.
## What changed
- Drop the classpath resource loader from the loader set used for weblog
rendering, and align the stale test copy of `velocity.properties`.
- Register an include event handler that confines `#include` / `#parse` to
the
theme namespace and refuses absolute paths, upward traversal, schemes, and
names that are neither a stored template id nor a `.vm` file.
- Keep `SecureUberspector` unchanged.
## Tests
`ThemeIncludeConfinementTest` covers loader set, handler registration, and
uberspector configuration; handler unit cases for refused and allowed names;
and
an end-to-end engine test that measures each control independently.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
