Resolve weblog template resources within the active theme - #172
Open
snoopdave wants to merge 4 commits into
Open
Resolve weblog template resources within the active theme#172snoopdave wants to merge 4 commits into
snoopdave wants to merge 4 commits into
Conversation
Weblog templates are authored by weblog administrators, whom Roller already treats as untrusted: the rendering engine runs them under SecureUberspector. That sandbox governs method access rather than resource resolution, so the loader set and the include directives are constrained to match it. The loader set for weblog rendering is now the webapp templates, the active theme, and the weblog's own stored templates. A ThemeIncludeEventHandler keeps #include and #parse within the namespace they are written in, refusing names that are absolute, walk upward, or carry a scheme. Macro libraries and feed templates resolve through the webapp loader and are unaffected.
The copy under src/test/resources had drifted: it carried a loader set the webapp no longer uses and lacked the introspection sandbox entirely. Nothing reads it today — the servlet context resolves /WEB-INF/velocity.properties from src/main/webapp — but a second configuration that disagrees with the shipped one is a configuration that can quietly become live. The configuration assertions now run over both files so they cannot drift apart again.
The include directives resolve names through whichever loaders are configured, so a name needs no traversal to reach whatever those loaders can see. Constrain the names themselves as well as the loader set: a stored template id carries no extension, and a theme resource is a Velocity template, so a name bearing some other extension is not a template reference and is refused. The engine test now measures the loader set and the include handler separately, against a reference rendering, so neither is resting on the other.
The engine test now demonstrates the classpath loader was reachable and is now closed against a generic test-fixture property rather than a named packaged resource, and the refused-name list uses generic paths. Claude-Session: https://claude.ai/code/session_01A1fhY1E2PCFU6UAPXu2WtV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weblog template rendering currently loads resources from the application
classpath in addition to the theme namespace. This change confines template
resource resolution to the active theme and restricts include targets to the
shapes a template actually takes.
What changed
rendering, and align the stale test copy of
velocity.properties.#include/#parseto thetheme namespace and refuses absolute paths, upward traversal, schemes, and
names that are neither a stored template id nor a
.vmfile.SecureUberspectorunchanged.Tests
ThemeIncludeConfinementTestcovers loader set, handler registration, anduberspector configuration; handler unit cases for refused and allowed names; and
an end-to-end engine test that measures each control independently.