Class SecureUberspector

  • All Implemented Interfaces:
    Uberspect, UberspectLoggable, RuntimeServicesAware

    public class SecureUberspector
    extends UberspectImpl
    implements RuntimeServicesAware
    Use a custom introspector that prevents classloader related method calls. Use this introspector for situations in which template writers are numerous or untrusted. Specifically, this introspector prevents creation of arbitrary objects or reflection on objects.

    To use this introspector, set the following property:

     runtime.introspector.uberspect = org.apache.velocity.util.introspection.SecureUberspector
     
    Since:
    1.5
    Version:
    $Id: SecureUberspector.java 774412 2009-05-13 15:54:07Z nbubna $
    • Constructor Detail

      • SecureUberspector

        public SecureUberspector()
    • Method Detail

      • init

        public void init()
        init - generates the Introspector. As the setup code makes sure that the log gets set before this is called, we can initialize the Introspector using the log object.
        Specified by:
        init in interface Uberspect
        Overrides:
        init in class UberspectImpl
      • getIterator

        public java.util.Iterator getIterator​(java.lang.Object obj,
                                              Info i)
                                       throws java.lang.Exception
        Get an iterator from the given object. Since the superclass method this secure version checks for execute permission.
        Specified by:
        getIterator in interface Uberspect
        Overrides:
        getIterator in class UberspectImpl
        Parameters:
        obj - object to iterate over
        i - line, column, template info
        Returns:
        Iterator for object
        Throws:
        java.lang.Exception
      • setRuntimeServices

        public void setRuntimeServices​(RuntimeServices rs)
        Store the RuntimeServices before the object is initialized..
        Specified by:
        setRuntimeServices in interface RuntimeServicesAware
        Parameters:
        rs - RuntimeServices object for initialization