001
014
015 package com.liferay.portal.freemarker;
016
017 import com.liferay.portal.util.ClassLoaderUtil;
018 import com.liferay.portal.util.PropsValues;
019
020 import freemarker.core.Environment;
021 import freemarker.core.TemplateClassResolver;
022
023 import freemarker.template.Template;
024 import freemarker.template.TemplateException;
025 import freemarker.template.utility.ObjectConstructor;
026
027
030 public class LiferayTemplateClassResolver implements TemplateClassResolver {
031
032 @Override
033 public Class<?> resolve(
034 String className, Environment environment, Template template)
035 throws TemplateException {
036
037 if (className.equals(ObjectConstructor.class.getName())) {
038 throw new TemplateException(
039 "Instantiating " + className + " is not allowed in the " +
040 "template for security reasons",
041 environment);
042 }
043
044 for (String restrictedClassName :
045 PropsValues.FREEMARKER_ENGINE_RESTRICTED_CLASSES) {
046
047 if (className.equals(restrictedClassName)) {
048 throw new TemplateException(
049 "Instantiating " + className + " is not allowed in the " +
050 "template for security reasons",
051 environment);
052 }
053 }
054
055 for (String restrictedPackageName :
056 PropsValues.FREEMARKER_ENGINE_RESTRICTED_PACKAGES) {
057
058 if (className.startsWith(restrictedPackageName)) {
059 throw new TemplateException(
060 "Instantiating " + className + " is not allowed in the " +
061 "template for security reasons",
062 environment);
063 }
064 }
065
066 try {
067 return Class.forName(
068 className, true, ClassLoaderUtil.getContextClassLoader());
069 }
070 catch (Exception e) {
071 throw new TemplateException(e, environment);
072 }
073 }
074
075 }