(velocity-site) branch main updated: Review security model paragraph to make it more explicit

[cb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/velocity-site.git


The following commit(s) were added to refs/heads/main by this push:
     new 4af31f62 Review security model paragraph to make it more explicit
4af31f62 is described below

commit 4af31f626d285e37693a2b9f25cc559642520b47
Author: Claude Brisson <cl...@renegat.net>
AuthorDate: Sun May 31 15:48:22 2026 +0200

    Review security model paragraph to make it more explicit
---
 src/content/index.mdtext | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/content/index.mdtext b/src/content/index.mdtext
index 5dab5466..f6038b37 100644
--- a/src/content/index.mdtext
+++ b/src/content/index.mdtext
@@ -48,9 +48,11 @@ The release distribution is available as a combined source/binary distribution i
 
 Velocity Engine and Velocity Tools rely on the template loaders defined in the `velocity.properties` configuration file and/or properties defined in the webapp descriptor or web container configuration. If those configurations are compromised, Velocity cannot ensure that templates do not come from a malicious source. This is **NOT** a Velocity vulnerability. If the attacker is already in control of the web application configuration files, they already have far more powerful attack vector [...]
 
+Resource roots are operator-controlled configuration, and template names passed to `URLResourceLoader`, `FileResourceLoader`, etc. are application-controlled — neither is request input under the documented threat model. Reports claiming SSRF or path traversal via these resolvers, on the assumption that the resource name is attacker-controlled, are therefore out of scope: template authorship and resource configuration are privileged operations. Applications that thread untrusted input int [...]
+
 ### Velocity Context
 
-Velocity Engine provides a SecureUberspector helper class which helps ensure that the Velocity context does not contain any dangerous class in a user-facing template editing scenario. But this class and its configuration are just provided as *a starting point*: Velocity cannot know in advance how the Velocity context is populated and cannot possibly ban all potentially dangerous classes. It is the responsibility of the application authors to audit every object placed in the context to en [...]
+Velocity Engine provides a SecureUberspector helper class which helps ensure that the Velocity context does not contain any dangerous class in a user-facing template editing scenario. But this class and its configuration are just provided as *a starting point*: Velocity cannot know in advance how the Velocity context is populated and cannot possibly ban all potentially dangerous classes. It is the responsibility of the application authors to audit every object placed in the context to en [...]
 
 ## More Information