Freemarker
Last updated
Was this helpful?
Last updated
Was this helpful?
FreeMarker uses the which consists of text, interpolation, FTL tags, and comments.
FreeMarker auto-escapes variables if the content type is an HTML document, while most other templating engines always escape HTML content unless specified not to. This make FreeMarker more susceptile to HTML injection (Figure 1.1) and XSS attacks (Figure 1.2).
Unlike PHP used in , Java uses cares about data types so if an integer is multiplied with a string, we expect to get an error (Figure 2).
The example below is based on OffSec's course.
We can leverage the class which implements the TemplateModel interface to achieve RCE in a FreeMarker templating engine.
