do not allow calling getClass

HubSpot · Aug 29, 2018 · 4f28830 · 4f28830
1 parent e0b1016
commit 4f28830
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/src/main/java/com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java b/src/main/java/com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java
@@ -20,6 +20,7 @@ public class JinjavaBeanELResolver extends BeanELResolver {
   private static final Set<String> RESTRICTED_METHODS = ImmutableSet.<String> builder()
       .add("clone")
       .add("hashCode")
+      .add("getClass")
       .add("notify")
       .add("notifyAll")
       .add("wait")

diff --git a/src/test/java/com/hubspot/jinjava/el/ExpressionResolverTest.java b/src/test/java/com/hubspot/jinjava/el/ExpressionResolverTest.java
@@ -333,11 +333,11 @@ public void blackListedProperties() {
   @Test
   public void blackListedMethods() {
     context.put("myobj", new MyClass(new Date(0)));
-    interpreter.resolveELExpression("myobj.wait()", -1);
+    interpreter.resolveELExpression("myobj.getClass()", -1);
 
     assertThat(interpreter.getErrorsCopy()).isNotEmpty();
     TemplateError e = interpreter.getErrorsCopy().get(0);
-    assertThat(e.getMessage()).contains("Cannot find method 'wait'");
+    assertThat(e.getMessage()).contains("Cannot find method 'getClass'");
   }
 
   @Test