Package org.apache.velocity.tools.generic

Class SafeConfig

java.lang.Object

org.apache.velocity.tools.generic.SafeConfig

Direct Known Subclasses:

AlternatorTool, ClassTool, CollectionTool, ContextTool, EscapeTool, FieldTool, ImportSupport, ImportTool, LinkTool, LocaleConfig, LogTool, LoopTool, MarkupTool, RenderTool, XmlTool

public class SafeConfig
extends java.lang.Object

Implements common logic and constants for tools which automatically locks down the public void configure(Map params) method after it is called once. This keeps application or session scoped tools thread-safe in templates, which generally have access to the tool after configuration has happened.

It also provides for a separate "safe mode" setting which tells tools to block any functions that may pose a security threat. This, of course, is set to true by default.

Once "locked down", the configure(Map) may still be called, however it will do nothing (unless some subclass is foolish enough to override it and not check if isConfigLocked() before changing configurations. The proper method for subclasses to override is configure(ValueParser) which will only be called by configure(Map) when the isConfigLocked() is false (i.e. the first time only).

Since:

VelocityTools 2.0

Author:

Nathan Bubna

Field Summary

Fields

Modifier and Type	Field	Description
static java.lang.String	LOCK_CONFIG_KEY	The key used for specifying whether or not to prevent templates from reconfiguring this tool.
protected org.slf4j.Logger	log
static java.lang.String	LOGGER_NAME_KEY	Key used to explicitely specify the logger name
static java.lang.String	SAFE_MODE_KEY	Many tools interested in locking configure() also have other things they wish to secure.
static java.lang.String	USE_CLASS_LOGGER_KEY	Key used to specify whether or not tools shall use loggers named after the tools classes.

Constructor Summary

Constructors

Constructor	Description
SafeConfig()

Method Summary

Modifier and Type	Method	Description
void	configure(java.util.Map<java.lang.String,java.lang.Object> params)	If isConfigLocked() returns true, then this method does nothing; otherwise, if false, this will create a new ValueParser from the specified Map of params and call configure(ValueParser) with it.
protected void	configure(ValueParser values)	Does the actual configuration.
protected org.slf4j.Logger	getLog()	Get logger
protected void	initLogger(ValueParser params)	Initialize logger.
boolean	isConfigLocked()	Returns true if the configure(Map) method has been locked.
boolean	isSafeMode()	Returns true if this tool is in "safe mode".
protected void	setLockConfig(boolean lock)	Only allow subclass access to this.
protected void	setSafeMode(boolean safe)	Set or clear safe mode.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOCK_CONFIG_KEY

public static final java.lang.String LOCK_CONFIG_KEY

The key used for specifying whether or not to prevent templates from reconfiguring this tool. The default is true.

See Also:

Constant Field Values

SAFE_MODE_KEY

public static final java.lang.String SAFE_MODE_KEY

Many tools interested in locking configure() also have other things they wish to secure. This key controls that property. The default value is true, of course.

See Also:

Constant Field Values

LOGGER_NAME_KEY

public static final java.lang.String LOGGER_NAME_KEY

Key used to explicitely specify the logger name

See Also:

Constant Field Values

USE_CLASS_LOGGER_KEY

public static final java.lang.String USE_CLASS_LOGGER_KEY

Key used to specify whether or not tools shall use loggers named after the tools classes.

See Also:

Constant Field Values

log

protected org.slf4j.Logger log

Constructor Detail

SafeConfig

public SafeConfig()

Method Detail

setLockConfig

protected void setLockConfig(boolean lock)

Only allow subclass access to this.

Parameters:

lock - whether to lock config

setSafeMode

protected void setSafeMode(boolean safe)

Set or clear safe mode.

Parameters:

safe - whether to set safe mode

isConfigLocked

public boolean isConfigLocked()

Returns true if the configure(Map) method has been locked.

Returns:

locked status

isSafeMode

public boolean isSafeMode()

Returns true if this tool is in "safe mode".

Returns:

safe mode status

configure

public void configure(java.util.Map<java.lang.String,java.lang.Object> params)

If isConfigLocked() returns true, then this method does nothing; otherwise, if false, this will create a new ValueParser from the specified Map of params and call configure(ValueParser) with it. Then this will check the parameters itself to find out whether or not the configuration for this tool should be put into safe mode or have its config locked. The safe mode value should be a boolean under the key SAFE_MODE_KEY and the lock value should be a boolean under the key LOCK_CONFIG_KEY.

Parameters:

params - configuration values map

configure

protected void configure(ValueParser values)

Does the actual configuration. This is protected, so subclasses may share the same ValueParser and call configure at any time, while preventing templates from doing so when configure(Map) is locked.

Parameters:

values - configuration values

initLogger

protected void initLogger(ValueParser params)

Initialize logger. Default implementation will try to get a Velocity engine from the configuration parameters, then try to use either the configured logger instance, or the configured logger name suffixed by 'tools.<key>'

Parameters:

params - configuration parameters

getLog

protected org.slf4j.Logger getLog()

Get logger

Returns:

logger