[jira] [Comment Edited] (OFBIZ-13371) Allow to optionally opt out from whitelisted static calls in Freemarker

["Konstantinos Marinos (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-13371?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18065777#comment-18065777 ] 

Konstantinos Marinos edited comment on OFBIZ-13371 at 3/13/26 9:27 PM:
-----------------------------------------------------------------------

Thank you for looking over my proposal. I have created a [PR|https://github.com/apache/ofbiz-framework/pull/983] that implements the details above.


was (Author: JIRAUSER310823):
Thank you for looking over my proposal. I have created a [PR|https://github.com/apache/ofbiz-framework/pull/983] that implement the details above.

> Allow to optionally opt out from whitelisted static calls in Freemarker
> -----------------------------------------------------------------------
>
>                 Key: OFBIZ-13371
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13371
>             Project: OFBiz
>          Issue Type: Improvement
>            Reporter: Konstantinos Marinos
>            Priority: Major
>             Fix For: 24.09.06
>
>
> Introduced in this commit [https://github.com/apache/ofbiz-framework/commit/05a0676c28b38324649fa1ecf8f46fcb9d38eabe], all static method (shared by the "Static" variable) in Freemarker templates need to be explicitly whitelisted so they can be called.
>  
> Although this gives a lot of control over the execution context inside the freemarker templates, it might translate to a lot of effort for existing projects that rely heavily on custom plugins to upgrade to this version without introducing breaking changes, since the maintainers or plugin authors would have to create a comprehensive list of all the fully qualified names of methods used so that it can be included in the whitelist.
>  
> For this reason, I propose to allow the whitelist to be turned off  globally through a security property (it can be configured to be enabled by default), to allow all projects to benefit from upgrading to this version but also be able to plan the effort for updating their whitelists at a more comfortable pace.
>  
> In any case, the developers that decide to go back to the unrestricted "Static" variable, should be warned in a comment about the implications of their decision.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)