bboss.org.apache.velocity.util.introspection

类 SecureIntrospectorImpl

java.lang.Object

bboss.org.apache.velocity.util.introspection.IntrospectorBase

bboss.org.apache.velocity.util.introspection.Introspector

bboss.org.apache.velocity.util.introspection.SecureIntrospectorImpl

所有已实现的接口:

SecureIntrospectorControl

public class SecureIntrospectorImpl
extends Introspector
implements SecureIntrospectorControl

Prevent "dangerous" classloader/reflection related calls. Use this introspector for situations in which template writers are numerous or untrusted. Specifically, this introspector prevents creation of arbitrary objects and prevents reflection on objects.

See documentation of checkObjectExecutePermission() for more information on specific classes and methods blocked.

从以下版本开始:

1.5

字段概要

从类继承的字段 bboss.org.apache.velocity.util.introspection.IntrospectorBase

log

构造器概要

构造器

构造器和说明
SecureIntrospectorImpl(java.lang.String[] badClasses, java.lang.String[] badPackages, Log log)

方法概要

限定符和类型	方法和说明
boolean	checkObjectExecutePermission(java.lang.Class clazz, java.lang.String methodName) Determine which methods and classes to prevent from executing.
java.lang.reflect.Method	getMethod(java.lang.Class clazz, java.lang.String methodName, java.lang.Object[] params) Get the Method object corresponding to the given class, name and parameters.

从类继承的方法 bboss.org.apache.velocity.util.introspection.IntrospectorBase

getIntrospectorCache

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

构造器详细资料

SecureIntrospectorImpl

public SecureIntrospectorImpl(java.lang.String[] badClasses,
                              java.lang.String[] badPackages,
                              Log log)

方法详细资料

getMethod

public java.lang.reflect.Method getMethod(java.lang.Class clazz,
                                          java.lang.String methodName,
                                          java.lang.Object[] params)
                                   throws java.lang.IllegalArgumentException

Get the Method object corresponding to the given class, name and parameters. Will check for appropriate execute permissions and return null if the method is not allowed to be executed.

覆盖:

getMethod 在类中 Introspector

参数:

clazz - Class on which method will be called

methodName - Name of method to be called

params - array of parameters to method

返回:

Method object retrieved by Introspector

抛出:

java.lang.IllegalArgumentException - The parameter passed in were incorrect.

checkObjectExecutePermission

public boolean checkObjectExecutePermission(java.lang.Class clazz,
                                            java.lang.String methodName)

Determine which methods and classes to prevent from executing. Always blocks methods wait() and notify(). Always allows methods on Number, Boolean, and String. Prohibits method calls on classes related to reflection and system operations. For the complete list, see the properties introspector.restrict.classes and introspector.restrict.packages.

指定者:

checkObjectExecutePermission 在接口中 SecureIntrospectorControl

参数:

clazz - Class on which method will be called

methodName - Name of method to be called

返回:

true if method may be called on object

另请参阅:

SecureIntrospectorControl.checkObjectExecutePermission(java.lang.Class, java.lang.String)