Package org.apache.velocity.util.introspection

Class SecureUberspector

java.lang.Object

org.apache.velocity.util.introspection.UberspectImpl

org.apache.velocity.util.introspection.SecureUberspector

All Implemented Interfaces:

Uberspect, RuntimeServicesAware

public class SecureUberspector
extends UberspectImpl

Use a custom introspector that prevents classloader related method calls. Use this introspector for situations in which template writers are numerous or untrusted. Specifically, this introspector prevents creation of arbitrary objects or reflection on objects.

To use this introspector, set the following property:

 introspector.uberspect.class = org.apache.velocity.util.introspection.SecureUberspector
 

Since:

1.5

Version:

$Id$

Author:

Will Glass-Husain

Nested Class Summary

Nested classes/interfaces inherited from class org.apache.velocity.util.introspection.UberspectImpl

UberspectImpl.VelGetterImpl, UberspectImpl.VelMethodImpl, UberspectImpl.VelSetterImpl

Field Summary

Fields inherited from class org.apache.velocity.util.introspection.UberspectImpl

conversionHandler, introspector, log, rsvc

Constructor Summary

Constructors

Constructor	Description
SecureUberspector()

Method Summary

Modifier and Type	Method	Description
Iterator	getIterator(Object obj, Info i)	Get an iterator from the given object.
VelMethod	getMethod(Object obj, String methodName, Object[] args, Info i)	Get a method from the given object.
void	init()	init - generates the Introspector.

Methods inherited from class org.apache.velocity.util.introspection.UberspectImpl

getConversionHandler, getPropertyGet, getPropertySet, setLog, setRuntimeServices

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SecureUberspector

public SecureUberspector()

Method Details

init

public void init()

init - generates the Introspector. As the setup code makes sure that the log gets set before this is called, we can initialize the Introspector using the log object.

Specified by:

init in interface Uberspect

Overrides:

init in class UberspectImpl

getMethod

public VelMethod getMethod(Object obj,
 String methodName,
 Object[] args,
 Info i)

Get a method from the given object. When the object is a Class, only allow Class.getName().

Specified by:

getMethod in interface Uberspect

Overrides:

getMethod in class UberspectImpl

Parameters:

obj - object on which the method is called

methodName - name of the called method

args - method arguments

i - line, column, template info

Returns:

Velocity method, or null when the call is not permitted

Since:

2.5

getIterator

public Iterator getIterator(Object obj,
 Info i)

Get an iterator from the given object. Since the superclass method this secure version checks for execute permission.

Specified by:

getIterator in interface Uberspect

Overrides:

getIterator in class UberspectImpl

Parameters:

obj - object to iterate over

i - line, column, template info

Returns:

Iterator for object