diff options
| author | Will Glass-Husain <wglass@forio.com> | 2020-07-16 22:31:22 -0700 |
|---|---|---|
| committer | Will Glass-Husain <wglass@forio.com> | 2020-07-16 22:31:22 -0700 |
| commit | 15909056fe51f5d39d49e101d706d3075876dde4 (patch) | |
| tree | 3f009303cc86bee1d04cf28980641343f13cdee1 /velocity-engine-core | |
| parent | 3e28c5fb7e618dc002cdbc6e4d0df9e2fd4bc155 (diff) | |
| download | apache-velocity-engine-15909056fe51f5d39d49e101d706d3075876dde4.tar.gz | |
update list of restricted classes
Diffstat (limited to 'velocity-engine-core')
| -rw-r--r-- | velocity-engine-core/src/test/resources/oldproperties/velocity.properties | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/velocity-engine-core/src/test/resources/oldproperties/velocity.properties b/velocity-engine-core/src/test/resources/oldproperties/velocity.properties index 65f8f561..6179f93b 100644 --- a/velocity-engine-core/src/test/resources/oldproperties/velocity.properties +++ b/velocity-engine-core/src/test/resources/oldproperties/velocity.properties @@ -220,9 +220,13 @@ runtime.conversion.handler.class = org.apache.velocity.util.introspection.TypeCo # accessed. # ---------------------------------------------------------------------------- +# Prohibit reflection introspector.restrict.packages = java.lang.reflect -## ClassLoader, Thread, and subclasses disabled by default in SecureIntrospectorImpl +# ClassLoader, Thread, and subclasses disabled by default in SecureIntrospectorImpl + +# Restrict these system classes. Note that anything in this list is matched exactly. +# (Subclasses must be explicitly named to be included). introspector.restrict.classes = java.lang.Class introspector.restrict.classes = java.lang.Compiler @@ -236,6 +240,12 @@ introspector.restrict.classes = java.lang.System introspector.restrict.classes = java.lang.ThreadGroup introspector.restrict.classes = java.lang.ThreadLocal +# Restrict instance managers for common servlet containers (Tomcat, JBoss, Jetty) + +introspector.restrict.classes = org.apache.catalina.core.DefaultInstanceManager +introspector.restrict.classes = org.wildfly.extension.undertow.deployment.UndertowJSPInstanceManager +introspector.restrict.classes = org.eclipse.jetty.util.DecoratedObjectFactory + # ---------------------------------------------------------------------------- # SPACE GOBBLING # ---------------------------------------------------------------------------- |