ChangdongLi opened a new pull request #68: URL: https://github.com/apache/freemarker/pull/68
many open source projects depend on Freemarker. They initialize Freemarker by calling the default Configuration constructor. e.g. JODReports. The default constructor - new Configuration() has built API enabled and can execute commands and can create some new instances. This can cause a critical security issue by default. This code change allows disabling those feature by calling Configuration.setDefaultNewBuiltinClassResolver(TemplateClassResolver.ALLOWS_NOTHING_RESOLVER); Configuration.setDefaultAPIBuiltinEnabled(false); Configuration.setExternalCommandsAllowed(false); Note those need to run before any new Configuration() code. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
