001    /**
002     * Copyright (c) 2000-2013 Liferay, Inc. All rights reserved.
003     *
004     * This library is free software; you can redistribute it and/or modify it under
005     * the terms of the GNU Lesser General Public License as published by the Free
006     * Software Foundation; either version 2.1 of the License, or (at your option)
007     * any later version.
008     *
009     * This library is distributed in the hope that it will be useful, but WITHOUT
010     * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
011     * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
012     * details.
013     */
014    
015    package com.liferay.portal.freemarker;
016    
017    import com.liferay.portal.util.ClassLoaderUtil;
018    import com.liferay.portal.util.PropsValues;
019    
020    import freemarker.core.Environment;
021    import freemarker.core.TemplateClassResolver;
022    
023    import freemarker.template.Template;
024    import freemarker.template.TemplateException;
025    import freemarker.template.utility.ObjectConstructor;
026    
027    /**
028     * @author Raymond Aug??
029     */
030    public class LiferayTemplateClassResolver implements TemplateClassResolver {
031    
032            @Override
033            public Class<?> resolve(
034                            String className, Environment environment, Template template)
035                    throws TemplateException {
036    
037                    if (className.equals(ObjectConstructor.class.getName())) {
038                            throw new TemplateException(
039                                    "Instantiating " + className + " is not allowed in the " +
040                                            "template for security reasons",
041                                    environment);
042                    }
043    
044                    for (String restrictedClassName :
045                                    PropsValues.FREEMARKER_ENGINE_RESTRICTED_CLASSES) {
046    
047                            if (className.equals(restrictedClassName)) {
048                                    throw new TemplateException(
049                                            "Instantiating " + className + " is not allowed in the " +
050                                                    "template for security reasons",
051                                            environment);
052                            }
053                    }
054    
055                    for (String restrictedPackageName :
056                                    PropsValues.FREEMARKER_ENGINE_RESTRICTED_PACKAGES) {
057    
058                            if (className.startsWith(restrictedPackageName)) {
059                                    throw new TemplateException(
060                                            "Instantiating " + className + " is not allowed in the " +
061                                                    "template for security reasons",
062                                            environment);
063                            }
064                    }
065    
066                    try {
067                            return Class.forName(
068                                    className, true, ClassLoaderUtil.getContextClassLoader());
069                    }
070                    catch (Exception e) {
071                            throw new TemplateException(e, environment);
072                    }
073            }
074    
075    }