RestrictedLiferayObjectWrapper extends LiferayObjectWrapper { @Override public TemplateModel wrap(Object object) throws TemplateModelException { if (object == null) { return null; } if (object instanceof TemplateModel) { return (TemplateModel)object; } Class<?> clazz = object.getClass(); String className = clazz.getName(); if (!_allowAllClasses && _isRestricted(clazz)) { return _LIFERAY_FREEMARKER_STRING_MODEL_FACTORY.create( object, this); } if (_restrictedMethodNames.containsKey(className)) { LiferayFreeMarkerStringModel liferayFreeMarkerStringModel = (LiferayFreeMarkerStringModel) _LIFERAY_FREEMARKER_STRING_MODEL_FACTORY.create( object, this); liferayFreeMarkerStringModel.setRestrictedMethodNames( _restrictedMethodNames.get(className)); return liferayFreeMarkerStringModel; } return super.wrap(object); } RestrictedLiferayObjectWrapper(
		String[] allowedClassNames, String[] restrictedClassNames,
		String[] restrictedMethodNames); @Override TemplateModel wrap(Object object);  }
@Test public void testRestrictedClass() throws Exception { RestrictedLiferayObjectWrapper restrictedLiferayObjectWrapper = new RestrictedLiferayObjectWrapper( null, new String[] {TestLiferayMethodObject.class.getName()}, null); TemplateModel templateModel = restrictedLiferayObjectWrapper.wrap( new TestLiferayMethodObject("test")); Assert.assertThat( templateModel, CoreMatchers.instanceOf(LiferayFreeMarkerStringModel.class)); LiferayFreeMarkerStringModel liferayFreeMarkerStringModel = (LiferayFreeMarkerStringModel)templateModel; _testRestrictedMethodNames(liferayFreeMarkerStringModel, "name"); _testRestrictedMethodNames(liferayFreeMarkerStringModel, "Name"); _testRestrictedMethodNames(liferayFreeMarkerStringModel, "getName"); _testRestrictedMethodNames(liferayFreeMarkerStringModel, "getname"); _testRestrictedMethodNames( liferayFreeMarkerStringModel, "generateName"); }
@Test public void testRestrictedMethodNames() throws Exception { RestrictedLiferayObjectWrapper restrictedLiferayObjectWrapper = new RestrictedLiferayObjectWrapper( null, null, new String[] { TestLiferayMethodObject.class.getName() + "#getName" }); TemplateModel templateModel = restrictedLiferayObjectWrapper.wrap( new TestLiferayMethodObject("test")); Assert.assertThat( templateModel, CoreMatchers.instanceOf(LiferayFreeMarkerStringModel.class)); LiferayFreeMarkerStringModel liferayFreeMarkerStringModel = (LiferayFreeMarkerStringModel)templateModel; _testRestrictedMethodNames(liferayFreeMarkerStringModel, "name"); _testRestrictedMethodNames(liferayFreeMarkerStringModel, "Name"); _testRestrictedMethodNames(liferayFreeMarkerStringModel, "getName"); _testRestrictedMethodNames(liferayFreeMarkerStringModel, "getname"); SimpleMethodModel simpleMethodModel = (SimpleMethodModel)liferayFreeMarkerStringModel.get("generate"); TemplateModel resultTemplateModel = (TemplateModel)simpleMethodModel.exec( Collections.singletonList(new SimpleScalar("generate"))); Assert.assertEquals("test-generate", resultTemplateModel.toString()); }
@Test public void testWrap() throws Exception { testWrap(new RestrictedLiferayObjectWrapper(null, null, null)); testWrap( new RestrictedLiferayObjectWrapper( new String[] {StringPool.STAR}, null, null)); testWrap( new RestrictedLiferayObjectWrapper( new String[] {StringPool.STAR}, new String[] {LiferayObjectWrapper.class.getName()}, null)); testWrap( new RestrictedLiferayObjectWrapper( new String[] {StringPool.BLANK}, null, null)); testWrap( new RestrictedLiferayObjectWrapper( null, new String[] {StringPool.BLANK}, null)); testWrap( new RestrictedLiferayObjectWrapper( new String[] {StringPool.BLANK}, new String[] {StringPool.BLANK}, null)); testWrap( new RestrictedLiferayObjectWrapper( new String[] {StringPool.BLANK}, new String[] {StringPool.BLANK}, new String[] {StringPool.BLANK})); testWrap( new RestrictedLiferayObjectWrapper( new String[] {StringPool.BLANK}, new String[] {StringPool.BLANK}, new String[] { TestLiferayMethodObject.class.getName() + "#getName" })); }