001
014
015 package com.liferay.portal.freemarker;
016
017 import com.liferay.portal.util.ClassLoaderUtil;
018 import com.liferay.portal.util.PropsValues;
019
020 import freemarker.core.Environment;
021 import freemarker.core.TemplateClassResolver;
022
023 import freemarker.template.Template;
024 import freemarker.template.TemplateException;
025 import freemarker.template.utility.ObjectConstructor;
026
027
030 public class LiferayTemplateClassResolver implements TemplateClassResolver {
031
032 public Class<?> resolve(
033 String className, Environment environment, Template template)
034 throws TemplateException {
035
036 if (className.equals(ObjectConstructor.class.getName())) {
037 throw new TemplateException(
038 "Instantiating " + className + " is not allowed in the " +
039 "template for security reasons",
040 environment);
041 }
042
043 for (String restrictedClassName :
044 PropsValues.FREEMARKER_ENGINE_RESTRICTED_CLASSES) {
045
046 if (className.equals(restrictedClassName)) {
047 throw new TemplateException(
048 "Instantiating " + className + " is not allowed in the " +
049 "template for security reasons",
050 environment);
051 }
052 }
053
054 for (String restrictedPackageName :
055 PropsValues.FREEMARKER_ENGINE_RESTRICTED_PACKAGES) {
056
057 if (className.startsWith(restrictedPackageName)) {
058 throw new TemplateException(
059 "Instantiating " + className + " is not allowed in the " +
060 "template for security reasons",
061 environment);
062 }
063 }
064
065 try {
066 return Class.forName(
067 className, true, ClassLoaderUtil.getContextClassLoader());
068 }
069 catch (Exception e) {
070 throw new TemplateException(e, environment);
071 }
072 }
073
074 }