VelocityHelper { public String evaluate(Reader templateReader, Map<String, Object> variables, String logTag) { VelocityContext velocityContext = new VelocityContext(variables); StringWriter writer = new StringWriter(); if (!Velocity.evaluate(velocityContext, writer, logTag, templateReader)) { throw new IllegalStateException("Error evaluating velocity template. See velocity log message for more details."); } return writer.toString(); } VelocityHelper(); String evaluate(Reader templateReader, Map<String, Object> variables, String logTag); String evaluate(String template, Map<String, Object> variables, String logTag);  }
@Test public void testEvaluate() { String template = "${foo}"; Map<String, Object> variables = new HashMap<>(); variables.put("foo", "bar"); String logTag = "test"; String result = velocityHelper.evaluate(template, variables, logTag); Assert.assertEquals("result", "bar", result); }
@Test public void testEvaluateReflection() { String template = "$foo.getClass().forName(\"java.lang.Runtime\").getRuntime().exec(\"cmd dir\")"; Map<String, Object> variables = new HashMap<>(); variables.put("foo", "bar"); String logTag = "test"; try { velocityHelper.evaluate(template, variables, logTag); fail(); } catch (MethodInvocationException methodInvocationException) { Assert.assertEquals("Exception message not equal.", "Object 'java.lang.Class' does not contain method forName(java.lang.String) at test[line 1, column 17]", methodInvocationException.getMessage()); } }