[jira] [Created] (FREEMARKER-124) Security - templates can get classloader by using java.security.ProtectionDomain.getClassLoader

Mon, 09 Dec 2019 01:20:41 -0800 

Gal Ben Ami created FREEMARKER-124:
--------------------------------------

             Summary: Security - templates can get classloader by using 
java.security.ProtectionDomain.getClassLoader
                 Key: FREEMARKER-124
                 URL: https://issues.apache.org/jira/browse/FREEMARKER-124
             Project: Apache Freemarker
          Issue Type: Bug
            Reporter: Gal Ben Ami


By using java.security.ProtectionDomain.getClassLoader templates will get 
access to the classloader and from there can get filesystem access and more.

 

See:

[https://github.com/apache/freemarker/pull/62]

 

And 

[https://ackcent.com/blog/in-depth-freemarker-template-injection/]

 



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Reply via email to