Template Injection (ARCH8130)
Ce contenu n’est pas encore disponible dans votre langue.
Key kotlin.security.template-injection · Severity error · Category security · CWE CWE-1336
Flags template engines given a template string built from request data (Template(name, StringReader($x)), templateEngine.process($x)).
Incorrect
Section titled “Incorrect”Template("t", StringReader(req.body), cfg).process(model, out)Correct
Section titled “Correct”cfg.getTemplate("welcome.ftl").process(model, out)Templates are files under your control; request data is only ever model data.