fix(security): freemarker SSTI vulnerability. (#1402)

halo-dev · Jun 20, 2021 · 5539cf1 · 5539cf1
1 parent e72fe21
commit 5539cf1
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/main/java/run/halo/app/listener/freemarker/FreemarkerConfigAwareListener.java b/src/main/java/run/halo/app/listener/freemarker/FreemarkerConfigAwareListener.java
@@ -2,6 +2,7 @@
 
 import static run.halo.app.model.support.HaloConst.OPTIONS_CACHE_KEY;
 
+import freemarker.core.TemplateClassResolver;
 import freemarker.template.Configuration;
 import freemarker.template.TemplateModel;
 import freemarker.template.TemplateModelException;
@@ -78,6 +79,7 @@ private Map<String, TemplateModel> freemarkerLayoutDirectives() {
 
     private void initFreemarkerConfig() throws TemplateModelException {
         configuration.setSharedVariable("layout", freemarkerLayoutDirectives());
+        configuration.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
     }
 
     @EventListener