[PR] Disable execution for freemarker.template.utility.Execute [freemarker]

["setuper (via GitHub)" <gi...@apache.org>]

setuper opened a new pull request, #122:
URL: https://github.com/apache/freemarker/pull/122

   This class can be used as a gadget for attack. It is suggested to make a setting to disable potentially dangerous code


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@freemarker.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Disable execution for freemarker.template.utility.Execute [freemarker]

["ddekany (via GitHub)" <gi...@apache.org>]

ddekany commented on PR #122:
URL: https://github.com/apache/freemarker/pull/122#issuecomment-2779598321

   Creating creating an instance of this `TemplateModel` from templates is disabled by default already (see `TemplateClassResolver.SAFER_RESOLVER`). So I'm note sure how much this helps in practice, as this doesn't block by default, and people had to realize that the problem exist at all, and then that there's a system property to block it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@freemarker.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org