Config freemarker with safer resolver

halo-dev · Dec 12, 2019 · dc3a73e · dc3a73e · JohnNiang · Dec 12, 2019
1 parent 568e487
commit dc3a73e
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/main/java/run/halo/app/config/WebMvcAutoConfiguration.java b/src/main/java/run/halo/app/config/WebMvcAutoConfiguration.java
@@ -1,6 +1,7 @@
 package run.halo.app.config;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import freemarker.core.TemplateClassResolver;
 import freemarker.template.TemplateException;
 import freemarker.template.TemplateExceptionHandler;
 import lombok.extern.slf4j.Slf4j;
@@ -131,6 +132,9 @@ public FreeMarkerConfigurer freemarkerConfig(HaloProperties haloProperties) thro
 
         // Predefine configuration
         freemarker.template.Configuration configuration = configurer.createConfiguration();
+
+        configuration.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
+
         if (haloProperties.isProductionEnv()) {
             configuration.setTemplateExceptionHandler(TemplateExceptionHandler.RETHROW_HANDLER);
         }