Package com.atlassian.confluence.impl.velocity

Class ConfluenceAllowlistIntrospector

java.lang.Object

org.apache.velocity.util.introspection.IntrospectorBase

org.apache.velocity.util.introspection.Introspector

org.apache.velocity.util.introspection.SecureIntrospectorImpl

com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector

com.atlassian.confluence.impl.velocity.ConfluenceAllowlistIntrospector

All Implemented Interfaces:

org.apache.velocity.util.introspection.SecureIntrospectorControl

public class ConfluenceAllowlistIntrospector
extends com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector

Integrates Confluence-specific allowlisting criteria into the PluginAwareSecureIntrospector.

Since:

9.0.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static @interface	ConfluenceAllowlistIntrospector.VelocityAllowlisted

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ANNOTATIONS_ENABLE_SYS_PROP	EXPERIMENTAL FEATURE - used for internal testing only.

Fields inherited from class com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector

ALLOWLIST_DEBUG_PROPERTY, ALLOWLIST_DEBUG_PROPERTY_ALT, ALLOWLIST_EXTRA_PROPERTY, ALLOWLIST_EXTRA_PROPERTY_ALT

Fields inherited from class org.apache.velocity.util.introspection.IntrospectorBase

log

Constructor Summary

Constructors

Constructor	Description
ConfluenceAllowlistIntrospector(org.apache.velocity.runtime.log.Log log, org.apache.velocity.runtime.RuntimeServices runtimeServices)

Method Summary

Modifier and Type	Method	Description
protected String	appendedToClassRelatedLogging(Class<?> clazz)
protected boolean	isAllowlistedMethodInternal(Method method)

Methods inherited from class com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector

isAllowlistDebugMode, isAllowlistedClassPackageCached, isAllowlistedMethodCached, isIntrospectorEnabled, loadClass, onPluginFrameworkStarted, setPluginAllowlist, toMethodStr

Methods inherited from class org.apache.velocity.util.introspection.SecureIntrospectorImpl

checkObjectExecutePermission, checkObjectExecutePermission, getMethod, getMethod, isAllowlisted, isAllowlistedClass, isAllowlistedClassPackageInternal, isAllowlistedInternal, isAllowlistEnabled, isClassPackageRestricted, isClassRestricted, isExecutionRestricted, isPackageMatches, isParametersRestricted, isParamsContainPathTraversal, isRestrictedClass, isRestrictedClassPackageCached, isRestrictedClassPackageInternal, loadClassAndLog, resolveArrayClass, toClassSet, toMethodSet, toPackageName, toParsedSet, topLevelChecks, toValidatedClassSet

Methods inherited from class org.apache.velocity.util.introspection.IntrospectorBase

getIntrospectorCache

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ANNOTATIONS_ENABLE_SYS_PROP

public static final String ANNOTATIONS_ENABLE_SYS_PROP

EXPERIMENTAL FEATURE - used for internal testing only.

See Also:

• Constant Field Values

Constructor Details

ConfluenceAllowlistIntrospector

public ConfluenceAllowlistIntrospector(org.apache.velocity.runtime.log.Log log,
 org.apache.velocity.runtime.RuntimeServices runtimeServices)

Method Details

isAllowlistedMethodInternal

protected boolean isAllowlistedMethodInternal(Method method)

Overrides:

isAllowlistedMethodInternal in class com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector

appendedToClassRelatedLogging

protected String appendedToClassRelatedLogging(Class<?> clazz)

Overrides:

appendedToClassRelatedLogging in class org.apache.velocity.util.introspection.SecureIntrospectorImpl