LiferayTemplateClassResolver implements TemplateClassResolver { @Override public Class<?> resolve( String className, Environment environment, Template template) throws TemplateException { if (className.equals(Execute.class.getName()) || className.equals(ObjectConstructor.class.getName())) { throw new TemplateException( StringBundler.concat( "Instantiating ", className, " is not allowed in the ", "template for security reasons"), environment); } String[] restrictedClassNames = GetterUtil.getStringValues( _freeMarkerEngineConfiguration.restrictedClasses()); for (String restrictedClassName : restrictedClassNames) { if (match(restrictedClassName, className)) { throw new TemplateException( StringBundler.concat( "Instantiating ", className, " is not allowed in the ", "template for security reasons"), environment); } } boolean allowed = false; String[] allowedClasseNames = GetterUtil.getStringValues( _freeMarkerEngineConfiguration.allowedClasses()); for (String allowedClassName : allowedClasseNames) { if (match(allowedClassName, className)) { allowed = true; break; } } if (allowed) { try { ClassLoader[] wwhitelistedClassLoaders = _whitelistedClassLoaders.toArray(new ClassLoader[0]); Thread currentThread = Thread.currentThread(); ClassLoader[] classLoaders = ArrayUtil.append( wwhitelistedClassLoaders, currentThread.getContextClassLoader()); ClassLoader wwhitelistedAggregateClassLoader = AggregateClassLoader.getAggregateClassLoader(classLoaders); return Class.forName( className, true, wwhitelistedAggregateClassLoader); } catch (Exception exception) { throw new TemplateException(exception, environment); } } throw new TemplateException( StringBundler.concat( "Instantiating ", className, " is not allowed in the template ", "for security reasons"), environment); }  @Override Class<?> resolve(
			String className, Environment environment, Template template);  }
@Test public void testResolveAllowedClassByClassName() throws Exception { _updateProperties("freemarker.template.utility.ClassUtil", ""); _liferayTemplateClassResolver.resolve( "freemarker.template.utility.ClassUtil", null, null); }
@Test public void testResolveAllowedClassByStar() throws Exception { _updateProperties("freemarker.template.utility.*", ""); _liferayTemplateClassResolver.resolve( "freemarker.template.utility.ClassUtil", null, null); }
@Test public void testResolveAllowedInvalidClass() throws Exception { _updateProperties("invalidClass", ""); try { _liferayTemplateClassResolver.resolve("invalidClass", null, null); Assert.fail(); } catch (TemplateException templateException) { ClassNotFoundException classNotFoundException = (ClassNotFoundException)templateException.getCause(); Assert.assertEquals( "invalidClass", classNotFoundException.getMessage()); } }
@Test public void testResolveAllowedPortalClass() throws Exception { _updateProperties("com.liferay.portal.kernel.model.User", null); _liferayTemplateClassResolver.resolve( "com.liferay.portal.kernel.model.User", null, null); }