[
https://issues.apache.org/jira/browse/VELOCITY-1001?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tagir Valeev updated VELOCITY-1001:
-----------------------------------
Description:
I've noticed that when we call a static method from the template, a
warning is issued like this:
82 [main] WARN org.apache.velocity.introspection - Cannot retrieve
method max from object of class java.lang.Class due to security
restrictions.
Nevertheless, the method is called correctly, and the template is
merged correctly. Here's a simple reproducer:
{{import org.apache.velocity.Template;}}
{{import org.apache.velocity.VelocityContext;}}
{{import org.apache.velocity.app.VelocityEngine;}}
{{import org.apache.velocity.runtime.RuntimeConstants;}}
{{import org.apache.velocity.runtime.resource.loader.StringResourceLoader;}}
{{{}import
org.apache.velocity.util.introspection.SecureUberspector;{}}}{{{}import
java.io.StringWriter;{}}}{{{}public class VelocityDemo {{}}}
{{ static {}}
{{ System.setProperty("org.slf4j.simpleLogger.logFile", "System.err");}}
{{ System.setProperty("org.slf4j.simpleLogger.defaultLogLevel",
"warn");}}
{{ System.setProperty("org.slf4j.simpleLogger.showDateTime", "true");}}
{{ }}}{{ private static final String TEMPLATE_NAME = "demo.vm";}}{{
private static final String TEMPLATE = """}}
{{ Hello, $name!}}
{{ Your lucky number is $math.round($math.random() * 100).}}
{{ The bigger of 3 and 7 is $math.max(3, 7).}}
{{ """;}}{{ public static void main(String[] args) {}}
{{ VelocityEngine engine = new VelocityEngine();}}
{{ engine.setProperty(RuntimeConstants.RESOURCE_LOADERS, "string");}}
{{ engine.setProperty("resource.loader.string.class",}}
{{StringResourceLoader.class.getName());}}
{{ engine.setProperty(RuntimeConstants.UBERSPECT_CLASSNAME,}}
{{SecureUberspector.class.getName());}}
{{ engine.init();}}{{
StringResourceLoader.getRepository().putStringResource(TEMPLATE_NAME,}}
{{TEMPLATE);}}
{{ VelocityContext context = new VelocityContext();}}
{{ context.put("name", "World");}}
{{ context.put("math", Math.class);}}{{ Template template =
engine.getTemplate(TEMPLATE_NAME);}}
{{ StringWriter out = new StringWriter();}}
{{ template.merge(context, out);}}{{ System.out.println(out);}}
{{ }}}
{{}}}
+deps: org.apache.velocity:velocity-engine-core:2.4.1,
org.slf4j:slf4j-simple:1.7.36
The output is the following:
{{55 [main] WARN org.apache.velocity.introspection - Cannot retrieve method
random from object of class java.lang.Class due to security restrictions.}}
{{75 [main] WARN org.apache.velocity.introspection - Cannot retrieve method
round from object of class java.lang.Class due to security restrictions.}}
{{82 [main] WARN org.apache.velocity.introspection - Cannot retrieve method max
from object of class java.lang.Class due to security restrictions.}}
{{Hello, World!}}
{{Your lucky number is 53.}}
{{The bigger of 3 and 7 is 7.}}
The reason is that for static methods, the qualifier is set to the
java.lang.Class pointing to a class containing the method. The
introspector first looks for the method inside the java.lang.Class,
and only after that tries to find a static method in the target class.
The warning adds a lot of noise to our logs. We can filter it out on
our side, but it would be nice to fix it in Velocity.
was:
I've noticed that when we call a static method from the template, a
warning is issued like this:
82 [main] WARN org.apache.velocity.introspection - Cannot retrieve
method max from object of class java.lang.Class due to security
restrictions.
Nevertheless, the method is called correctly, and the template is
merged correctly. Here's a simple reproducer:
{{import org.apache.velocity.Template;
import org.apache.velocity.VelocityContext;
import org.apache.velocity.app.VelocityEngine;
import org.apache.velocity.runtime.RuntimeConstants;
import org.apache.velocity.runtime.resource.loader.StringResourceLoader;
import org.apache.velocity.util.introspection.SecureUberspector;
import java.io.StringWriter;
public class VelocityDemo {
static {
System.setProperty("org.slf4j.simpleLogger.logFile", "System.err");
System.setProperty("org.slf4j.simpleLogger.defaultLogLevel", "warn");
System.setProperty("org.slf4j.simpleLogger.showDateTime", "true");
}
private static final String TEMPLATE_NAME = "demo.vm";
private static final String TEMPLATE = """
Hello, $name!
Your lucky number is $math.round($math.random() * 100).
The bigger of 3 and 7 is $math.max(3, 7).
""";
public static void main(String[] args) {
VelocityEngine engine = new VelocityEngine();
engine.setProperty(RuntimeConstants.RESOURCE_LOADERS, "string");
engine.setProperty("resource.loader.string.class",
StringResourceLoader.class.getName());
engine.setProperty(RuntimeConstants.UBERSPECT_CLASSNAME,
SecureUberspector.class.getName());
engine.init();
StringResourceLoader.getRepository().putStringResource(TEMPLATE_NAME,
TEMPLATE);
VelocityContext context = new VelocityContext();
context.put("name", "World");
context.put("math", Math.class);
Template template = engine.getTemplate(TEMPLATE_NAME);
StringWriter out = new StringWriter();
template.merge(context, out);
System.out.println(out);
}
}}}
+deps: org.apache.velocity:velocity-engine-core:2.4.1,
org.slf4j:slf4j-simple:1.7.36
The output is the following:
55 [main] WARN org.apache.velocity.introspection - Cannot retrieve
method random from object of class java.lang.Class due to security
restrictions.
75 [main] WARN org.apache.velocity.introspection - Cannot retrieve
method round from object of class java.lang.Class due to security
restrictions.
82 [main] WARN org.apache.velocity.introspection - Cannot retrieve
method max from object of class java.lang.Class due to security
restrictions.
Hello, World!
Your lucky number is 53.
The bigger of 3 and 7 is 7.
The reason is that for static methods, the qualifier is set to the
java.lang.Class pointing to a class containing the method. The
introspector first looks for the method inside the java.lang.Class,
and only after that tries to find a static method in the target class.
The warning adds a lot of noise to our logs. We can filter it out on
our side, but it would be nice to fix it in Velocity.
> An unwanted warning message in logs when calling a static method with
> SecureUberspector on
> ------------------------------------------------------------------------------------------
>
> Key: VELOCITY-1001
> URL: https://issues.apache.org/jira/browse/VELOCITY-1001
> Project: Velocity
> Issue Type: Bug
> Components: Engine
> Affects Versions: 2.4.1
> Reporter: Tagir Valeev
> Priority: Minor
>
> I've noticed that when we call a static method from the template, a
> warning is issued like this:
> 82 [main] WARN org.apache.velocity.introspection - Cannot retrieve
> method max from object of class java.lang.Class due to security
> restrictions.
> Nevertheless, the method is called correctly, and the template is
> merged correctly. Here's a simple reproducer:
> {{import org.apache.velocity.Template;}}
> {{import org.apache.velocity.VelocityContext;}}
> {{import org.apache.velocity.app.VelocityEngine;}}
> {{import org.apache.velocity.runtime.RuntimeConstants;}}
> {{import org.apache.velocity.runtime.resource.loader.StringResourceLoader;}}
> {{{}import
> org.apache.velocity.util.introspection.SecureUberspector;{}}}{{{}import
> java.io.StringWriter;{}}}{{{}public class VelocityDemo {{}}}
> {{ static {}}
> {{ System.setProperty("org.slf4j.simpleLogger.logFile",
> "System.err");}}
> {{ System.setProperty("org.slf4j.simpleLogger.defaultLogLevel",
> "warn");}}
> {{ System.setProperty("org.slf4j.simpleLogger.showDateTime", "true");}}
> {{ }}}{{ private static final String TEMPLATE_NAME = "demo.vm";}}{{
> private static final String TEMPLATE = """}}
> {{ Hello, $name!}}
> {{ Your lucky number is $math.round($math.random() * 100).}}
> {{ The bigger of 3 and 7 is $math.max(3, 7).}}
> {{ """;}}{{ public static void main(String[] args) {}}
> {{ VelocityEngine engine = new VelocityEngine();}}
> {{ engine.setProperty(RuntimeConstants.RESOURCE_LOADERS, "string");}}
> {{ engine.setProperty("resource.loader.string.class",}}
> {{StringResourceLoader.class.getName());}}
> {{ engine.setProperty(RuntimeConstants.UBERSPECT_CLASSNAME,}}
> {{SecureUberspector.class.getName());}}
> {{ engine.init();}}{{
> StringResourceLoader.getRepository().putStringResource(TEMPLATE_NAME,}}
> {{TEMPLATE);}}
> {{ VelocityContext context = new VelocityContext();}}
> {{ context.put("name", "World");}}
> {{ context.put("math", Math.class);}}{{ Template template =
> engine.getTemplate(TEMPLATE_NAME);}}
> {{ StringWriter out = new StringWriter();}}
> {{ template.merge(context, out);}}{{ System.out.println(out);}}
> {{ }}}
> {{}}}
> +deps: org.apache.velocity:velocity-engine-core:2.4.1,
> org.slf4j:slf4j-simple:1.7.36
> The output is the following:
> {{55 [main] WARN org.apache.velocity.introspection - Cannot retrieve method
> random from object of class java.lang.Class due to security restrictions.}}
> {{75 [main] WARN org.apache.velocity.introspection - Cannot retrieve method
> round from object of class java.lang.Class due to security restrictions.}}
> {{82 [main] WARN org.apache.velocity.introspection - Cannot retrieve method
> max from object of class java.lang.Class due to security restrictions.}}
> {{Hello, World!}}
> {{Your lucky number is 53.}}
> {{The bigger of 3 and 7 is 7.}}
> The reason is that for static methods, the qualifier is set to the
> java.lang.Class pointing to a class containing the method. The
> introspector first looks for the method inside the java.lang.Class,
> and only after that tries to find a static method in the target class.
> The warning adds a lot of noise to our logs. We can filter it out on
> our side, but it would be nice to fix it in Velocity.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
