Class SecureUberspector
java.lang.Object
org.apache.velocity.util.introspection.UberspectImpl
org.apache.velocity.util.introspection.SecureUberspector
- All Implemented Interfaces:
Uberspect
,UberspectLoggable
,RuntimeServicesAware
Use a custom introspector that prevents classloader related method
calls. Use this introspector for situations in which template
writers are numerous or untrusted. Specifically, this introspector
prevents creation of arbitrary objects or reflection on objects.
To use this introspector, set the following property:
runtime.introspector.uberspect = org.apache.velocity.util.introspection.SecureUberspector
- Since:
- 1.5
- Version:
- $Id: SecureUberspector.java 774412 2009-05-13 15:54:07Z nbubna $
-
Nested Class Summary
Nested classes/interfaces inherited from class org.apache.velocity.util.introspection.UberspectImpl
UberspectImpl.VelGetterImpl, UberspectImpl.VelMethodImpl, UberspectImpl.VelSetterImpl
-
Field Summary
FieldsFields inherited from class org.apache.velocity.util.introspection.UberspectImpl
introspector, log
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptiongetIterator
(Object obj, Info i) Get an iterator from the given object.void
init()
init - generates the Introspector.void
Store the RuntimeServices before the object is initialized..Methods inherited from class org.apache.velocity.util.introspection.UberspectImpl
getMethod, getPropertyGet, getPropertySet, setLog, setRuntimeLogger
-
Field Details
-
runtimeServices
RuntimeServices runtimeServices
-
-
Constructor Details
-
SecureUberspector
public SecureUberspector()
-
-
Method Details
-
init
public void init()init - generates the Introspector. As the setup code makes sure that the log gets set before this is called, we can initialize the Introspector using the log object.- Specified by:
init
in interfaceUberspect
- Overrides:
init
in classUberspectImpl
-
getIterator
Get an iterator from the given object. Since the superclass method this secure version checks for execute permission.- Specified by:
getIterator
in interfaceUberspect
- Overrides:
getIterator
in classUberspectImpl
- Parameters:
obj
- object to iterate overi
- line, column, template info- Returns:
- Iterator for object
- Throws:
Exception
-
setRuntimeServices
Store the RuntimeServices before the object is initialized..- Specified by:
setRuntimeServices
in interfaceRuntimeServicesAware
- Parameters:
rs
- RuntimeServices object for initialization
-