Template Injection (ARCH8130)
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Key kotlin.security.template-injection · Severity error · Category security · CWE CWE-1336
Flags template engines given a template string built from request data (Template(name, StringReader($x)), templateEngine.process($x)).
Incorrect
Section titled “Incorrect”Template("t", StringReader(req.body), cfg).process(model, out)Correct
Section titled “Correct”cfg.getTemplate("welcome.ftl").process(model, out)Templates are files under your control; request data is only ever model data.