Merge pull request #230 from HubSpot/do-not-allow-calling-getClass

do not allow calling getClass
HubSpot · Aug 29, 2018 · c13927d · c13927d · ThaVosMan · Aug 30, 2018
2 parents e0b1016 + 4f28830
commit c13927d
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/src/main/java/com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java b/src/main/java/com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java
@@ -20,6 +20,7 @@ public class JinjavaBeanELResolver extends BeanELResolver {
   private static final Set<String> RESTRICTED_METHODS = ImmutableSet.<String> builder()
       .add("clone")
       .add("hashCode")
+      .add("getClass")
       .add("notify")
       .add("notifyAll")
       .add("wait")

diff --git a/src/test/java/com/hubspot/jinjava/el/ExpressionResolverTest.java b/src/test/java/com/hubspot/jinjava/el/ExpressionResolverTest.java
@@ -333,11 +333,11 @@ public void blackListedProperties() {
   @Test
   public void blackListedMethods() {
     context.put("myobj", new MyClass(new Date(0)));
-    interpreter.resolveELExpression("myobj.wait()", -1);
+    interpreter.resolveELExpression("myobj.getClass()", -1);
 
     assertThat(interpreter.getErrorsCopy()).isNotEmpty();
     TemplateError e = interpreter.getErrorsCopy().get(0);
-    assertThat(e.getMessage()).contains("Cannot find method 'wait'");
+    assertThat(e.getMessage()).contains("Cannot find method 'getClass'");
   }
 
   @Test