Package com.atlassian.confluence.impl.velocity

Class ConfluenceAllowlistIntrospector

java.lang.Object
org.apache.velocity.util.introspection.IntrospectorBase
org.apache.velocity.util.introspection.Introspector
org.apache.velocity.util.introspection.SecureIntrospectorImpl
com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector
com.atlassian.confluence.impl.velocity.ConfluenceAllowlistIntrospector
All Implemented Interfaces:
org.apache.velocity.util.introspection.SecureIntrospectorControl
public class ConfluenceAllowlistIntrospector extends com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector
Integrates Confluence-specific allowlisting criteria into the PluginAwareSecureIntrospector.
Since:
9.0.0

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    static @interface 
    ConfluenceAllowlistIntrospector.VelocityAllowlisted
     

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    ANNOTATIONS_ENABLE_SYS_PROP
    EXPERIMENTAL FEATURE - used for internal testing only.

    Fields inherited from class com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector

    ALLOWLIST_DEBUG_PROPERTY, ALLOWLIST_DEBUG_PROPERTY_ALT, ALLOWLIST_EXTRA_PROPERTY, ALLOWLIST_EXTRA_PROPERTY_ALT

    Fields inherited from class org.apache.velocity.util.introspection.IntrospectorBase

    log

  • Constructor Summary

    Constructors
    Constructor
    Description
    ConfluenceAllowlistIntrospector(org.apache.velocity.runtime.log.Log log, org.apache.velocity.runtime.RuntimeServices runtimeServices)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected boolean
    isAllowlistedMethodInternal(Method method)
     

    Methods inherited from class com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector

    isAllowlistDebugMode, isAllowlistedClassPackageCached, isAllowlistedMethodCached, isIntrospectorEnabled, loadClass, onPluginFrameworkStarted, setPluginAllowlist, toMethodStr

    Methods inherited from class org.apache.velocity.util.introspection.SecureIntrospectorImpl

    checkObjectExecutePermission, checkObjectExecutePermission, getMethod, getMethod, isAllowlisted, isAllowlistedClass, isAllowlistedClassPackageInternal, isAllowlistedInternal, isAllowlistEnabled, isClassPackageRestricted, isClassRestricted, isExecutionRestricted, isPackageMatches, isParametersRestricted, isParamsContainPathTraversal, isRestrictedClass, isRestrictedClassPackageCached, isRestrictedClassPackageInternal, resolveArrayClass, toClassSet, toMethodSet, toPackageName, toParsedSet, topLevelChecks, toValidatedClassSet

    Methods inherited from class org.apache.velocity.util.introspection.IntrospectorBase

    getIntrospectorCache

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • ANNOTATIONS_ENABLE_SYS_PROP

      public static final String ANNOTATIONS_ENABLE_SYS_PROP
      EXPERIMENTAL FEATURE - used for internal testing only.
      See Also:

  • Constructor Details

    • ConfluenceAllowlistIntrospector

      public ConfluenceAllowlistIntrospector(org.apache.velocity.runtime.log.Log log, org.apache.velocity.runtime.RuntimeServices runtimeServices)

  • Method Details

    • isAllowlistedMethodInternal

      protected boolean isAllowlistedMethodInternal(Method method)
      Overrides:
      isAllowlistedMethodInternal in class com.atlassian.velocity.allowlist.uberspect.PluginAwareSecureIntrospector