Class SecureUberspector
- java.lang.Object
-
- org.apache.velocity.util.introspection.UberspectImpl
-
- org.apache.velocity.util.introspection.SecureUberspector
-
- All Implemented Interfaces:
Uberspect
,UberspectLoggable
,RuntimeServicesAware
public class SecureUberspector extends UberspectImpl implements RuntimeServicesAware
Use a custom introspector that prevents classloader related method calls. Use this introspector for situations in which template writers are numerous or untrusted. Specifically, this introspector prevents creation of arbitrary objects or reflection on objects.To use this introspector, set the following property:
runtime.introspector.uberspect = org.apache.velocity.util.introspection.SecureUberspector
- Since:
- 1.5
- Version:
- $Id: SecureUberspector.java 774412 2009-05-13 15:54:07Z nbubna $
-
-
Nested Class Summary
-
Nested classes/interfaces inherited from class org.apache.velocity.util.introspection.UberspectImpl
UberspectImpl.VelGetterImpl, UberspectImpl.VelMethodImpl, UberspectImpl.VelSetterImpl
-
-
Field Summary
Fields Modifier and Type Field Description (package private) RuntimeServices
runtimeServices
-
Fields inherited from class org.apache.velocity.util.introspection.UberspectImpl
introspector, log
-
-
Constructor Summary
Constructors Constructor Description SecureUberspector()
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description java.util.Iterator
getIterator(java.lang.Object obj, Info i)
Get an iterator from the given object.void
init()
init - generates the Introspector.void
setRuntimeServices(RuntimeServices rs)
Store the RuntimeServices before the object is initialized..-
Methods inherited from class org.apache.velocity.util.introspection.UberspectImpl
getMethod, getPropertyGet, getPropertySet, setLog, setRuntimeLogger
-
-
-
-
Field Detail
-
runtimeServices
RuntimeServices runtimeServices
-
-
Method Detail
-
init
public void init()
init - generates the Introspector. As the setup code makes sure that the log gets set before this is called, we can initialize the Introspector using the log object.- Specified by:
init
in interfaceUberspect
- Overrides:
init
in classUberspectImpl
-
getIterator
public java.util.Iterator getIterator(java.lang.Object obj, Info i) throws java.lang.Exception
Get an iterator from the given object. Since the superclass method this secure version checks for execute permission.- Specified by:
getIterator
in interfaceUberspect
- Overrides:
getIterator
in classUberspectImpl
- Parameters:
obj
- object to iterate overi
- line, column, template info- Returns:
- Iterator for object
- Throws:
java.lang.Exception
-
setRuntimeServices
public void setRuntimeServices(RuntimeServices rs)
Store the RuntimeServices before the object is initialized..- Specified by:
setRuntimeServices
in interfaceRuntimeServicesAware
- Parameters:
rs
- RuntimeServices object for initialization
-
-