Package com.atlassian.velocity.allowlist.uberspect

Class PluginAwareSecureIntrospector

java.lang.Object
org.apache.velocity.util.introspection.IntrospectorBase
org.apache.velocity.util.introspection.Introspector
org.apache.velocity.util.introspection.SecureIntrospectorImpl
com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector
All Implemented Interfaces:
org.apache.velocity.util.introspection.SecureIntrospectorControl
public class PluginAwareSecureIntrospector extends org.apache.velocity.util.introspection.SecureIntrospectorImpl
Extension of SecureIntrospectorImpl which can additionally consult the PluginAllowlist. In addition to configuring this Introspector for use in the Velocity engine, the engine internal instance must then be retrieved and initialised by calling setPluginAllowlist(com.atlassian.velocity.allowlist.api.internal.PluginAllowlist) and registered as an event listener.
Since:
6.0.0

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    ALLOWLIST_DEBUG_PROPERTY
     
    static final String
    ALLOWLIST_DEBUG_PROPERTY_ALT
     

    Fields inherited from class org.apache.velocity.util.introspection.IntrospectorBase

    log

  • Constructor Summary

    Constructors
    Constructor
    Description
    PluginAwareSecureIntrospector(org.apache.velocity.runtime.log.Log log, org.apache.velocity.runtime.RuntimeServices runtimeServices)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected boolean
    isAllowlistDebugMode()
     
    protected boolean
    isAllowlistedClassPackageCached(Class<?> clazz)
     
    protected boolean
    isAllowlistedMethodCached(Method method)
     
    protected boolean
    isIntrospectorEnabled()
     
    protected Class<?>
    loadClass(String name)
     
    void
    onPluginFrameworkStarted(com.atlassian.plugin.event.events.PluginFrameworkStartedEvent event)
     
    void
    setPluginAllowlist(PluginAllowlist pluginAllowlist)
     

    Methods inherited from class org.apache.velocity.util.introspection.SecureIntrospectorImpl

    checkObjectExecutePermission, checkObjectExecutePermission, getMethod, getMethod, isAllowlisted, isAllowlistedClass, isAllowlistedClassPackageInternal, isAllowlistedInternal, isAllowlistedMethodInternal, isAllowlistEnabled, isClassPackageRestricted, isClassRestricted, isExecutionRestricted, isPackageMatches, isParametersRestricted, isParamsContainPathTraversal, isRestrictedClass, isRestrictedClassPackageCached, isRestrictedClassPackageInternal, resolveArrayClass, toClassSet, toMethodSet, toPackageName, toParsedSet, topLevelChecks, toValidatedClassSet

    Methods inherited from class org.apache.velocity.util.introspection.IntrospectorBase

    getIntrospectorCache

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

  • Constructor Details

    • PluginAwareSecureIntrospector

      public PluginAwareSecureIntrospector(org.apache.velocity.runtime.log.Log log, org.apache.velocity.runtime.RuntimeServices runtimeServices)

  • Method Details

    • setPluginAllowlist

      public void setPluginAllowlist(PluginAllowlist pluginAllowlist)

    • loadClass

      protected Class<?> loadClass(String name) throws ClassNotFoundException
      Overrides:
      loadClass in class org.apache.velocity.util.introspection.SecureIntrospectorImpl
      Throws:
      ClassNotFoundException

    • onPluginFrameworkStarted

      @EventListener public void onPluginFrameworkStarted(com.atlassian.plugin.event.events.PluginFrameworkStartedEvent event)

    • isIntrospectorEnabled

      protected boolean isIntrospectorEnabled()
      Overrides:
      isIntrospectorEnabled in class org.apache.velocity.util.introspection.SecureIntrospectorImpl

    • isAllowlistDebugMode

      protected boolean isAllowlistDebugMode()
      Overrides:
      isAllowlistDebugMode in class org.apache.velocity.util.introspection.SecureIntrospectorImpl

    • isAllowlistedClassPackageCached

      protected boolean isAllowlistedClassPackageCached(Class<?> clazz)
      Overrides:
      isAllowlistedClassPackageCached in class org.apache.velocity.util.introspection.SecureIntrospectorImpl

    • isAllowlistedMethodCached

      protected boolean isAllowlistedMethodCached(Method method)
      Overrides:
      isAllowlistedMethodCached in class org.apache.velocity.util.introspection.SecureIntrospectorImpl