Have Geek Brain

Is freemarker safe when user can edit their template

I'm new to freemarker, I need to know about this issue, also choose it or not, I will strip XSS myself, but I don't know if the other freemarker features are safe when the site allows the user to edit their template?

0


a source to share


3 answers


Oh god no! This is basically equivalent to allowing the user to evaluate arbitrary code. Removing XSS after the fact only addresses one potential vulnerability. They will still be able to do a lot of other things, like manipulating POST parameters or performing page redirects.



0


a source


John is right. And letting the user actually edit the freemarker templates themselves seems strange. If you re-enter user input (for example, display your search query on the results page), I would suggest using with an inline inline html string, this saves you the most basic xss attacks (eg "you searched" '$ {term? HTML} '").
0


a source


So as others have said, it is not safe. However, if these users are employees of your company or something like that (that is, if they are easily accountable for malicious acts), then this is not entirely out of the question. See http://freemarker.org/docs/app_faq.html#faq_template_uploading_security for details

0


a source






More articles:


All Articles