Tracker: Patches

5 <exec> support for freemarker - ID: 415033
Last Update: Comment added ( run2000 )

This patch implements <exec> tag support for
freemarker. It has only been tested on linux. <exex
"command"> will fork a process, and inline anything
that process sends to stdout in the template. we've
used this to integrate htdig support into a site
entirely built with freemarker and java servlets, since
our navigation framework resides entirely in freemarker
templates, and we didn't want to duplicate that work in
the htdig results page script.

BE CAREFUL! this tag, depending on use, may allow you
to set something up so that users of your web
application could run arbitrary code on your server.
This can only happen if you allow unchecked GET/POST
submissions to be used as the command string in the
exec tag.


INSTALLATION

unpack the tarball in your freemarker153 directory. It
contains three files: EXEC_INSTALL.txt, exec.patch, and
src/freemarker/template/instruction/ExecInstruction.java.

run "patch
src/freemarker/template/compiler/StandardTemplateParser.java
exec.patch"

rebuild your freemarker.jar.


Peter Molettiere
senior engineer
sfinteractive

peter molettiere ( p1etr0 ) - 2001-04-09 16:56:44 PDT

5

Closed

Accepted

Nicholas Cull

None

None

Public


Comments ( 5 )

Date: 2001-05-10 03:35:06 PDT
Sender: run2000

Logged In: YES
user_id=137221

Checked into CVS 10 May 2001.

Date: 2001-05-08 05:19:25 PDT
Sender: run2000

Logged In: YES
user_id=137221

Accepting, though the final version will appear as a TemplateMethodModel.
Will hopefully make CVS in the next few days :)

Nicholas.

Date: 2001-04-16 11:06:18 PDT
Sender: p1etr0

Logged In: YES
user_id=192625

The main reason we decided to implement as a tag, rather
than a TemplateMethodModel was simply due to past experience
with server side includes. We were used to being able to
exec server side stuffies with an exec tag.

Now that I think about it, it could certainly be implemented
as a TemplateMethodModel.

P)

Date: 2001-04-14 03:31:47 PDT
Sender: run2000

Logged In: YES
user_id=137221

Hi Peter,

Thanks for the patch.

Now, a question for you: how come you chose to implement this as a whole
new tag, as opposed to implementing a TemplateMethodModel?

Date: 2001-04-09 17:00:52 PDT
Sender: p1etr0

Logged In: YES
user_id=192625

urp... didn't click "check to upload & attach file"

Attached File ( 1 )

Filename Description Download
exec.tgz patch tarball Download

Changes ( 6 )

Field Old Value Date By
status_id Open 2001-05-10 03:35:06 PDT run2000
close_date - 2001-05-10 03:35:06 PDT run2000
resolution_id None 2001-05-08 05:19:25 PDT run2000
assigned_to nobody 2001-04-20 16:48:03 PDT run2000
summary <exec> support for freemarker 2001-04-20 16:48:03 PDT run2000
File Added 5173: exec.tgz 2001-04-09 17:00:53 PDT p1etr0