001    /**
002     * Copyright (c) 2000-2013 Liferay, Inc. All rights reserved.
003     *
004     * The contents of this file are subject to the terms of the Liferay Enterprise
005     * Subscription License ("License"). You may not use this file except in
006     * compliance with the License. You can obtain a copy of the License by
007     * contacting Liferay, Inc. See the License for the specific language governing
008     * permissions and limitations under the License, including but not limited to
009     * distribution rights of the Software.
010     *
011     *
012     *
013     */
014    
015    package com.liferay.portal.freemarker;
016    
017    import com.liferay.portal.util.ClassLoaderUtil;
018    import com.liferay.portal.util.PropsValues;
019    
020    import freemarker.core.Environment;
021    import freemarker.core.TemplateClassResolver;
022    
023    import freemarker.template.Template;
024    import freemarker.template.TemplateException;
025    import freemarker.template.utility.ObjectConstructor;
026    
027    /**
028     * @author Raymond Aug??
029     */
030    public class LiferayTemplateClassResolver implements TemplateClassResolver {
031    
032            @Override
033            public Class<?> resolve(
034                            String className, Environment environment, Template template)
035                    throws TemplateException {
036    
037                    if (className.equals(ObjectConstructor.class.getName())) {
038                            throw new TemplateException(
039                                    "Instantiating " + className + " is not allowed in the " +
040                                            "template for security reasons",
041                                    environment);
042                    }
043    
044                    for (String restrictedClassName :
045                                    PropsValues.FREEMARKER_ENGINE_RESTRICTED_CLASSES) {
046    
047                            if (className.equals(restrictedClassName)) {
048                                    throw new TemplateException(
049                                            "Instantiating " + className + " is not allowed in the " +
050                                                    "template for security reasons",
051                                            environment);
052                            }
053                    }
054    
055                    for (String restrictedPackageName :
056                                    PropsValues.FREEMARKER_ENGINE_RESTRICTED_PACKAGES) {
057    
058                            if (className.startsWith(restrictedPackageName)) {
059                                    throw new TemplateException(
060                                            "Instantiating " + className + " is not allowed in the " +
061                                                    "template for security reasons",
062                                            environment);
063                            }
064                    }
065    
066                    try {
067                            return Class.forName(
068                                    className, true, ClassLoaderUtil.getContextClassLoader());
069                    }
070                    catch (Exception e) {
071                            throw new TemplateException(e, environment);
072                    }
073            }
074    
075    }