diff --git a/freemarker-core/src/main/java/freemarker/template/utility/Execute.java b/freemarker-core/src/main/java/freemarker/template/utility/Execute.java index aa7fb1c48..2b6753bf4 100644 --- a/freemarker-core/src/main/java/freemarker/template/utility/Execute.java +++ b/freemarker-core/src/main/java/freemarker/template/utility/Execute.java @@ -61,6 +61,7 @@ public class Execute implements freemarker.template.TemplateMethodModel { private final static int OUTPUT_BUFFER_SIZE = 1024; + private final static boolean DISABLE_EXECUTE = SecurityUtilities.getSystemProperty("freemarker.template.disableExecute", null) != null; /** * Executes a method call. @@ -74,6 +75,9 @@ public Object exec (List arguments) throws TemplateModelException { String aExecute; StringBuilder aOutputBuffer = new StringBuilder(); + if ( DISABLE_EXECUTE ) { + throw new TemplateModelException( "Execution disabled" ); + } if ( arguments.size() < 1 ) { throw new TemplateModelException( "Need an argument to execute" ); }