Remove possibility to turn sandbox off via template

PebbleTemplates · May 18, 2020 · c75c17a · c75c17a
1 parent b7d6374
commit c75c17a
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 17 deletions.
diff --git a/docs/src/orchid/resources/changelog/v3_1_4.md b/docs/src/orchid/resources/changelog/v3_1_4.md
@@ -5,5 +5,6 @@ version: '3.1.4'
 - Slice filter: Use collection size when toIndex is greater than collection size  (#504)
 - Adjust spring boot doc (#509) 
 - Build with jdk14 (#508)
-- Set proxyBeanMethods to false (#507)
-- Add access to Spring Beans/request/session and response when using Pebble with WebFlux (#512)
+- Set proxyBeanMethods to false and build with spring boot 2.3 (#507)
+- Add access to Spring Beans/request/session and response when using Pebble with WebFlux (#512)
+- Remove allowUnsafeMethods property and replace it with methodAccessValidator. Default one is BlacklistMethodAccessValidtor (#511)  
diff --git a/pebble/src/main/java/com/mitchellbosecke/pebble/PebbleEngine.java b/pebble/src/main/java/com/mitchellbosecke/pebble/PebbleEngine.java
@@ -583,10 +583,8 @@ public PebbleEngine build() {
       parserOptions.setLiteralDecimalTreatedAsInteger(this.literalDecimalTreatedAsInteger);
       parserOptions.setLiteralNumbersAsBigDecimals(this.literalNumbersAsBigDecimals);
 
-      EvaluationOptions evaluationOptions = new EvaluationOptions();
-      evaluationOptions.setMethodAccessValidator(this.methodAccessValidator);
-      evaluationOptions.setGreedyMatchMethod(this.greedyMatchMethod);
-
+      EvaluationOptions evaluationOptions = new EvaluationOptions(this.greedyMatchMethod,
+          this.methodAccessValidator);
       return new PebbleEngine(this.loader, this.syntax, this.strictVariables, this.defaultLocale,
           this.tagCache, this.templateCache,
           this.executorService, extensionRegistry, parserOptions, evaluationOptions);

diff --git a/pebble/src/main/java/com/mitchellbosecke/pebble/template/EvaluationOptions.java b/pebble/src/main/java/com/mitchellbosecke/pebble/template/EvaluationOptions.java
@@ -8,30 +8,28 @@
  * @author yanxiyue
  */
 public class EvaluationOptions {
+
   /**
    * toggle to enable/disable greedy matching mode for finding java method
    */
-  private boolean greedyMatchMethod;
+  private final boolean greedyMatchMethod;
 
   /**
    * Validator that can be used to validate object/method access
    */
-  private MethodAccessValidator methodAccessValidator;
+  private final MethodAccessValidator methodAccessValidator;
 
-  public boolean isGreedyMatchMethod() {
-    return this.greedyMatchMethod;
+  public EvaluationOptions(boolean greedyMatchMethod,
+      MethodAccessValidator methodAccessValidator) {
+    this.greedyMatchMethod = greedyMatchMethod;
+    this.methodAccessValidator = methodAccessValidator;
   }
 
-  public void setGreedyMatchMethod(boolean greedyMatchMethod) {
-    this.greedyMatchMethod = greedyMatchMethod;
+  public boolean isGreedyMatchMethod() {
+    return this.greedyMatchMethod;
   }
 
   public MethodAccessValidator getMethodAccessValidator() {
     return this.methodAccessValidator;
   }
-
-  public void setMethodAccessValidator(
-      MethodAccessValidator methodAccessValidator) {
-    this.methodAccessValidator = methodAccessValidator;
-  }
 }