001    /**
002     * Copyright (c) 2000-2012 Liferay, Inc. All rights reserved.
003     *
004     * This library is free software; you can redistribute it and/or modify it under
005     * the terms of the GNU Lesser General Public License as published by the Free
006     * Software Foundation; either version 2.1 of the License, or (at your option)
007     * any later version.
008     *
009     * This library is distributed in the hope that it will be useful, but WITHOUT
010     * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
011     * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
012     * details.
013     */
014    
015    package com.liferay.portal.freemarker;
016    
017    import com.liferay.portal.util.ClassLoaderUtil;
018    import com.liferay.portal.util.PropsValues;
019    
020    import freemarker.core.Environment;
021    import freemarker.core.TemplateClassResolver;
022    
023    import freemarker.template.Template;
024    import freemarker.template.TemplateException;
025    import freemarker.template.utility.ObjectConstructor;
026    
027    /**
028     * @author Raymond Augé
029     */
030    public class LiferayTemplateClassResolver implements TemplateClassResolver {
031    
032            public Class<?> resolve(
033                            String className, Environment environment, Template template)
034                    throws TemplateException {
035    
036                    if (className.equals(ObjectConstructor.class.getName())) {
037                            throw new TemplateException(
038                                    "Instantiating " + className + " is not allowed in the " +
039                                            "template for security reasons",
040                                    environment);
041                    }
042    
043                    for (String restrictedClassName :
044                                    PropsValues.FREEMARKER_ENGINE_RESTRICTED_CLASSES) {
045    
046                            if (className.equals(restrictedClassName)) {
047                                    throw new TemplateException(
048                                            "Instantiating " + className + " is not allowed in the " +
049                                                    "template for security reasons",
050                                            environment);
051                            }
052                    }
053    
054                    for (String restrictedPackageName :
055                                    PropsValues.FREEMARKER_ENGINE_RESTRICTED_PACKAGES) {
056    
057                            if (className.startsWith(restrictedPackageName)) {
058                                    throw new TemplateException(
059                                            "Instantiating " + className + " is not allowed in the " +
060                                                    "template for security reasons",
061                                            environment);
062                            }
063                    }
064    
065                    try {
066                            return Class.forName(
067                                    className, true, ClassLoaderUtil.getContextClassLoader());
068                    }
069                    catch (Exception e) {
070                            throw new TemplateException(e, environment);
071                    }
072            }
073    
074    }