Issue #298 CVE-2024-41667 (#299)

openam-jp · Aug 8, 2024 · e8c1660 · e8c1660
1 parent 8981568
commit e8c1660
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/openam-oauth2/src/main/java/org/forgerock/oauth2/core/OAuth2ProviderSettings.java b/openam-oauth2/src/main/java/org/forgerock/oauth2/core/OAuth2ProviderSettings.java
@@ -13,7 +13,7 @@
  *
  * Copyright 2014-2016 ForgeRock AS.
  * Portions Copyrighted 2015 Nomura Research Institute, Ltd.
- * Portions copyright 2019 Open Source Solution Technology Corporation
+ * Portions copyright 2019-2024 OSSTech Corporation
  */
 
 package org.forgerock.oauth2.core;
@@ -54,6 +54,7 @@
 import com.sun.identity.sm.SMSException;
 import com.sun.identity.sm.ServiceConfigManager;
 import com.sun.identity.sm.ServiceListener;
+import freemarker.core.TemplateClassResolver;
 import freemarker.template.Configuration;
 import freemarker.template.Template;
 import org.forgerock.guice.core.InjectorHolder;
@@ -1170,6 +1171,7 @@ public Template getCustomLoginUrlTemplate() throws ServerException {
             if (loginUrlTemplateString != null) {
                 loginUrlTemplate = new Template("customLoginUrlTemplate", new StringReader(loginUrlTemplateString),
                         new Configuration());
+                loginUrlTemplate.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
             }
             return loginUrlTemplate;
         } catch (SSOException | IOException | SMSException e) {