Template injection (ARCH4130)

Key java.security.template-injection · Severity error · Category security · CWE CWE-1336

Building the template string itself from untrusted input lets attackers evaluate template-engine expressions and run code on the server (SSTI/RCE).

Incorrect

String tpl = "Hello " + request.getParameter("name");
Template t = new Template("t", new StringReader(tpl), cfg);
t.process(model, out);

Correct

Template t = cfg.getTemplate("hello.ftl");
Map<String, Object> model = Map.of("name", request.getParameter("name"));
t.process(model, out);

Fix

Use fixed, predefined templates and pass user input only into the data model, never into the template source.