#15 <exec> support for freemarker

closed-accepted
Nicholas Cull
None
5
2001-05-10
2001-04-09
peter molettiere
No

This patch implements <exec> tag support for
freemarker. It has only been tested on linux. <exex
"command"> will fork a process, and inline anything
that process sends to stdout in the template. we've
used this to integrate htdig support into a site
entirely built with freemarker and java servlets, since
our navigation framework resides entirely in freemarker
templates, and we didn't want to duplicate that work in
the htdig results page script.

BE CAREFUL! this tag, depending on use, may allow you
to set something up so that users of your web
application could run arbitrary code on your server.
This can only happen if you allow unchecked GET/POST
submissions to be used as the command string in the
exec tag.

INSTALLATION

unpack the tarball in your freemarker153 directory. It
contains three files: EXEC_INSTALL.txt, exec.patch, and
src/freemarker/template/instruction/ExecInstruction.java.

run "patch
src/freemarker/template/compiler/StandardTemplateParser.java
exec.patch"

rebuild your freemarker.jar.

Peter Molettiere
senior engineer
sfinteractive

Discussion

  • patch tarball

     
    Attachments
  • Logged In: YES
    user_id=192625

    urp... didn't click "check to upload & attach file"

     
  • Nicholas Cull
    Nicholas Cull
    2001-04-14

    Logged In: YES
    user_id=137221

    Hi Peter,

    Thanks for the patch.

    Now, a question for you: how come you chose to implement this as a whole new tag, as opposed to implementing a TemplateMethodModel?

     
  • Logged In: YES
    user_id=192625

    The main reason we decided to implement as a tag, rather
    than a TemplateMethodModel was simply due to past experience
    with server side includes. We were used to being able to
    exec server side stuffies with an exec tag.

    Now that I think about it, it could certainly be implemented
    as a TemplateMethodModel.

    P)

     
  • Nicholas Cull
    Nicholas Cull
    2001-04-20

    • assigned_to: nobody --> run2000
    • summary: <exec> support for freemarker --> &lt;exec&gt; support for freemarker
     
  • Nicholas Cull
    Nicholas Cull
    2001-05-08

    • status: open --> open-accepted
     
  • Nicholas Cull
    Nicholas Cull
    2001-05-08

    Logged In: YES
    user_id=137221

    Accepting, though the final version will appear as a TemplateMethodModel. Will hopefully make CVS in the next few days :)

    Nicholas.

     
  • Nicholas Cull
    Nicholas Cull
    2001-05-10

    Logged In: YES
    user_id=137221

    Checked into CVS 10 May 2001.

     
  • Nicholas Cull
    Nicholas Cull
    2001-05-10

    • status: open-accepted --> closed-accepted