flawopen.com/SSTI/FreeMarker & Velocity

Are FreeMarker and Velocity Templates Safe with User Input?

// Risk: parse request data as template source
String src = "Hello " + userSuppliedName;
Template t = new Template("t", src, cfg);
t.process(model, writer);

// Risk: evaluate a user-controlled VTL string
Velocity.evaluate(context, writer,
                  "log", userTemplate);

// Trusted classpath template; scalar-only model
Configuration cfg = new Configuration(
    Configuration.VERSION_2_3_34);
cfg.setTemplateLoader(new ClassTemplateLoader(
    App.class, "/templates"));
cfg.setNewBuiltinClassResolver(
    TemplateClassResolver.ALLOWS_NOTHING_RESOLVER);
cfg.setObjectWrapper(new SimpleObjectWrapper(
    Configuration.VERSION_2_3_34));
Template t = cfg.getTemplate("hello.ftl");
Map<String,Object> model = Map.of(
    "name", userSuppliedName);
t.process(model, writer);

// Velocity: trusted template with restricted introspection
Properties p = new Properties();
p.setProperty("resource.loaders", "class");
p.setProperty("resource.loader.class.class",
    ClasspathResourceLoader.class.getName());
p.setProperty("runtime.introspector.uberspect",
    SecureUberspector.class.getName());
VelocityEngine engine = new VelocityEngine();
engine.init(p);
Template vt = engine.getTemplate("hello.vm", "UTF-8");
VelocityContext vc = new VelocityContext();
vc.put("name", userSuppliedName);
vt.merge(vc, writer);

Why Java engines escalate so cleanly

Templates evaluate expressions against a data model, but the Java surface exposed to those expressions is configuration-dependent. FreeMarker's default object wrapper can expose JavaBean properties and methods for arbitrary POJOs; the available members depend on the wrapper and member-access policy. Velocity's default Uberspect maps template properties to public Java methods. Neither fact means every model exposes unrestricted reflection: risk increases when the model contains service objects, class loaders, request objects, or other powerful capabilities. Prefer maps of strings and other simple values, and expose only the fields each trusted template needs.

FreeMarker's ?new built-in can instantiate classes that implement TemplateModel. Apache advises restricting class resolution for uploaded templates; its SAFER_RESOLVER still permits some classes, while ALLOWS_NOTHING_RESOLVER denies all class resolution. This control does not replace a restricted object wrapper and a minimal data model.

Hardening, and its limits

• ✓FreeMarker: for untrusted templates, set new_builtin_class_resolver to ALLOWS_NOTHING_RESOLVER and use a wrapper such as SimpleObjectWrapper that rejects arbitrary POJOs. Pass only simple, purpose-built model values.
• ✓Velocity: use SecureUberspector when templates are untrusted, and give the context only the simple values the template needs. It blocks documented reflection and object-creation paths; it is not an operating-system sandbox.
• ✓Both: load application templates from a trusted, integrity-controlled loader. Never turn request parameters or user-writable database rows into template source.
• ✓If user-authored templates are a product requirement: render them in a separate, minimally privileged process with no network access, secrets, or writable application files; enforce CPU, memory, and wall-clock limits outside the template engine.

Treat engine restrictions as defense in depth, not as process isolation. Pin supported versions, review the exact configuration against the engine's current security guidance, and keep the renderer away from secrets and privileged application objects.

FAQ

References

• Apache FreeMarker — FAQ on template uploading security
• Apache FreeMarker — SimpleObjectWrapper API
• Apache FreeMarker — TemplateClassResolver API
• Apache Velocity — developer guide
• Apache Velocity 2.3 — classpath resource loader API
• PortSwigger — server-side template injection
• CWE-1336 — Server-Side Template Injection