Package freemarker.cache
Class FileTemplateLoader
- java.lang.Object
-
- freemarker.cache.FileTemplateLoader
-
- All Implemented Interfaces:
TemplateLoader
public class FileTemplateLoader extends Object implements TemplateLoader
ATemplateLoader
that uses files inside a specified directory as the source of templates. By default it does security checks on the canonical path that will prevent it serving templates outside that specified directory. If you want symbolic links that point outside the template directory to work, you need to disable this feature by usingFileTemplateLoader(File, boolean)
withtrue
second argument, but before that, check the security implications there!
-
-
Field Summary
Fields Modifier and Type Field Description File
baseDir
static String
SYSTEM_PROPERTY_NAME_EMULATE_CASE_SENSITIVE_FILE_SYSTEM
By setting this Java system property totrue
, you can change the default of#getEmulateCaseSensitiveFileSystem()
.
-
Constructor Summary
Constructors Constructor Description FileTemplateLoader()
Deprecated.Relying on what the current directory is is a bad practice; useFileTemplateLoader(File)
instead.FileTemplateLoader(File baseDir)
Creates a new file template loader that will use the specified directory as the base directory for loading templates.FileTemplateLoader(File baseDir, boolean disableCanonicalPathCheck)
Creates a new file template loader that will use the specified directory as the base directory for loading templates.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description void
closeTemplateSource(Object templateSource)
Closes the template source, releasing any resources held that are only required for reading the template and/or its metadata.Object
findTemplateSource(String name)
Finds the template in the backing storage and returns an object that identifies the storage location where the template can be loaded from.File
getBaseDirectory()
Returns the base directory in which the templates are searched.boolean
getEmulateCaseSensitiveFileSystem()
Getter pair ofsetEmulateCaseSensitiveFileSystem(boolean)
.protected boolean
getEmulateCaseSensitiveFileSystemDefault()
Returns the default ofgetEmulateCaseSensitiveFileSystem()
.long
getLastModified(Object templateSource)
Returns the time of last modification of the specified template source.Reader
getReader(Object templateSource, String encoding)
Returns the character stream of a template represented by the specified template source.void
setEmulateCaseSensitiveFileSystem(boolean nameCaseChecked)
Intended for development only, checks if the template name matches the case (upper VS lower case letters) of the actual file name, and if it doesn't, it emulates a file-not-found even if the file system is case insensitive.String
toString()
Show class name and some details that are useful in template-not-found errors.
-
-
-
Constructor Detail
-
FileTemplateLoader
public FileTemplateLoader() throws IOException
Deprecated.Relying on what the current directory is is a bad practice; useFileTemplateLoader(File)
instead.Creates a new file template cache that will use the current directory (the value of the system propertyuser.dir
as the base directory for loading templates. It will not allow access to template files that are accessible through symlinks that point outside the base directory.- Throws:
IOException
-
FileTemplateLoader
public FileTemplateLoader(File baseDir) throws IOException
Creates a new file template loader that will use the specified directory as the base directory for loading templates. It will not allow access to template files that are accessible through symlinks that point outside the base directory.- Parameters:
baseDir
- the base directory for loading templates- Throws:
IOException
-
FileTemplateLoader
public FileTemplateLoader(File baseDir, boolean disableCanonicalPathCheck) throws IOException
Creates a new file template loader that will use the specified directory as the base directory for loading templates. See the parameters for allowing symlinks that point outside the base directory.- Parameters:
baseDir
- the base directory for loading templatesdisableCanonicalPathCheck
- Iftrue
, it will not check if the file to be loaded is inside thebaseDir
or not, according the canonical paths of thebaseDir
and the file to load. Note thatConfiguration.getTemplate(String)
and (its overloads) already prevents backing out from the template directory with paths like/../../../etc/password
, however, that can be circumvented with symbolic links or other file system features. If you really want to use symbolic links that point outside thebaseDir
, set this parameter totrue
, but then be very careful with template paths that are supplied by the visitor or an external system.- Throws:
IOException
-
-
Method Detail
-
findTemplateSource
public Object findTemplateSource(String name) throws IOException
Description copied from interface:TemplateLoader
Finds the template in the backing storage and returns an object that identifies the storage location where the template can be loaded from. See the return value for more information.- Specified by:
findTemplateSource
in interfaceTemplateLoader
- Parameters:
name
- The name of the template, already localized and normalized by thecache
. It is completely up to the loader implementation to interpret the name, however it should expect to receive hierarchical paths where path components are separated by a slash (not backslash). Backslashes (or any other OS specific separator character) are not considered as separators by FreeMarker, and thus they will not be replaced with slash before passing to this method, so it's up to the template loader to handle them (say, be throwing and exception that tells the user that the path (s)he has entered is invalid, as (s)he must use slash -- typical mistake of Windows users). The passed names are always considered relative to some loader-defined root location (often referred as the "template root directory"), and will never start with a slash, nor will they contain a path component consisting of either a single or a double dot -- these are all resolved by the template cache before passing the name to the loader. As a side effect, paths that trivially reach outside template root directory, such as ../my.ftl, will be rejected by the template cache, so they never reach the template loader. Note again, that if the path uses backslash as path separator instead of slash as (the template loader should not accept that), the normalization will not properly happen, as FreeMarker (the cache) recognizes only the slashes as separators.- Returns:
- An object representing the template source, which can be supplied in subsequent calls to
TemplateLoader.getLastModified(Object)
andTemplateLoader.getReader(Object, String)
, when those are called on the sameTemplateLoader
.null
must be returned if the source for the template doesn't exist; don't throw exception then! The exact type of this object is up to theTemplateLoader
implementation. As this object is possibly used as hash key in caches, and is surly compared with another template source for equality, it must have a properObject.equals(Object)
andObject.hashCode()
) implementation. Especially, template sources that refer to the same physical source must be equivalent, otherwise template caching can become inefficient. This is only expected fromObject.equals(Object)
when the compared template sources came from the sameTemplateLoader
instance. Also, it must not influence the equality if the source is open or closed (TemplateLoader.closeTemplateSource(Object)
). - Throws:
IOException
- When an error occurs that makes it impossible to find out if the template exists, or to access the existing template. Don't throw exception if the template doesn't exist, instead return withnull
then!
-
getLastModified
public long getLastModified(Object templateSource)
Description copied from interface:TemplateLoader
Returns the time of last modification of the specified template source. This method is called afterfindTemplateSource()
.- Specified by:
getLastModified
in interfaceTemplateLoader
- Parameters:
templateSource
- an object representing a template source, obtained through a prior call toTemplateLoader.findTemplateSource(String)
. This must be an object on whichTemplateLoader.closeTemplateSource(Object)
wasn't applied yet.- Returns:
- the time of last modification of the specified template source, or -1 if the time is not known.
-
getReader
public Reader getReader(Object templateSource, String encoding) throws IOException
Description copied from interface:TemplateLoader
Returns the character stream of a template represented by the specified template source. This method is possibly called for multiple times for the same template source object, and it must always return aReader
that reads the template from its beginning. Before this method is called for the second time (or later), its caller must close the previously returnedReader
, and it must not use it anymore. That is, this method is not required to support multiple concurrent readers for the same sourcetemplateSource
object.Typically, this method is called if the template is missing from the cache, or if after calling
TemplateLoader.findTemplateSource(String)
andTemplateLoader.getLastModified(Object)
it was determined that the cached copy of the template is stale. Then, if it turns out that theencoding
parameter used doesn't match the actual template content (based on the#ftl encoding=...
header), this method will be called for a second time with the correctencoding
parameter value.- Specified by:
getReader
in interfaceTemplateLoader
- Parameters:
templateSource
- an object representing a template source, obtained through a prior call toTemplateLoader.findTemplateSource(String)
. This must be an object on whichTemplateLoader.closeTemplateSource(Object)
wasn't applied yet.encoding
- the character encoding used to translate source bytes to characters. Some loaders may not have access to the byte representation of the template stream, and instead directly obtain a character stream. These loaders should ignore the encoding parameter.- Returns:
- A
Reader
representing the template character stream. It's the responsibility of the caller (which isTemplateCache
usually) toclose()
it. TheReader
is not required to work after thetemplateSource
was closed (TemplateLoader.closeTemplateSource(Object)
). - Throws:
IOException
- if an I/O error occurs while accessing the stream.
-
closeTemplateSource
public void closeTemplateSource(Object templateSource)
Description copied from interface:TemplateLoader
Closes the template source, releasing any resources held that are only required for reading the template and/or its metadata. This is the last method that is called by theTemplateCache
for a template source, except thatObject.equals(Object)
is might called later too.TemplateCache
ensures that this method will be called on every object that is returned fromTemplateLoader.findTemplateSource(String)
.- Specified by:
closeTemplateSource
in interfaceTemplateLoader
- Parameters:
templateSource
- the template source that should be closed.
-
getBaseDirectory
public File getBaseDirectory()
Returns the base directory in which the templates are searched. This comes from the constructor argument, but it's possibly a canonicalized version of that.- Since:
- 2.3.21
-
setEmulateCaseSensitiveFileSystem
public void setEmulateCaseSensitiveFileSystem(boolean nameCaseChecked)
Intended for development only, checks if the template name matches the case (upper VS lower case letters) of the actual file name, and if it doesn't, it emulates a file-not-found even if the file system is case insensitive. This is useful when developing application on Windows, which will be later installed on Linux, OS X, etc. This check can be resource intensive, as to check the file name the directories involved, up to thegetBaseDirectory()
directory, must be listed. Positive results (matching case) will be cached without expiration time.The default in
FileTemplateLoader
isfalse
, but subclasses may change they by overridinggetEmulateCaseSensitiveFileSystemDefault()
.- Since:
- 2.3.23
-
getEmulateCaseSensitiveFileSystem
public boolean getEmulateCaseSensitiveFileSystem()
Getter pair ofsetEmulateCaseSensitiveFileSystem(boolean)
.- Since:
- 2.3.23
-
getEmulateCaseSensitiveFileSystemDefault
protected boolean getEmulateCaseSensitiveFileSystemDefault()
Returns the default ofgetEmulateCaseSensitiveFileSystem()
. InFileTemplateLoader
it'sfalse
, unless theSYSTEM_PROPERTY_NAME_EMULATE_CASE_SENSITIVE_FILE_SYSTEM
system property was set totrue
, but this can be overridden here in custom subclasses. For example, if your environment defines something like developer mode, you may want to override this to returntrue
on Windows.- Since:
- 2.3.23
-
-