diff --git a/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/dynamic/db/FreemarkerParseFactory.java b/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/dynamic/db/FreemarkerParseFactory.java
index 90b7c446..f59f4057 100644
--- a/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/dynamic/db/FreemarkerParseFactory.java
+++ b/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/dynamic/db/FreemarkerParseFactory.java
@@ -34,11 +34,11 @@ public class FreemarkerParseFactory {
/**
* 文件缓存
*/
- private static final Configuration TPL_CONFIG = new Configuration();
+ private static final Configuration TPL_CONFIG = new Configuration(Configuration.DEFAULT_INCOMPATIBLE_IMPROVEMENTS);
/**
* SQL 缓存
*/
- private static final Configuration SQL_CONFIG = new Configuration();
+ private static final Configuration SQL_CONFIG = new Configuration(Configuration.DEFAULT_INCOMPATIBLE_IMPROVEMENTS);
private static StringTemplateLoader stringTemplateLoader = new StringTemplateLoader();
@@ -47,8 +47,7 @@ public class FreemarkerParseFactory {
.compile("(?ms)/\\*.*?\\*/|^\\s*//.*?$");
static {
- TPL_CONFIG.setClassForTemplateLoading(
- new FreemarkerParseFactory().getClass(), "/");
+ TPL_CONFIG.setClassForTemplateLoading(new FreemarkerParseFactory().getClass(), "/");
TPL_CONFIG.setNumberFormat("0.#####################");
SQL_CONFIG.setTemplateLoader(stringTemplateLoader);
SQL_CONFIG.setNumberFormat("0.#####################");
@@ -57,6 +56,7 @@ public class FreemarkerParseFactory {
//update-begin-author:taoyan date:2022-8-10 for: freemarker模板注入问题 禁止解析ObjectConstructor,Execute和freemarker.template.utility.JythonRuntime。
//https://ackcent.com/in-depth-freemarker-template-injection/
+ TPL_CONFIG.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
SQL_CONFIG.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
//update-end-author:taoyan date:2022-8-10 for: freemarker模板注入问题 禁止解析ObjectConstructor,Execute和freemarker.template.utility.JythonRuntime。
}
@@ -169,7 +169,7 @@ public class FreemarkerParseFactory {
//"where and"
String whereAnd = DataBaseConstant.SQL_WHERE+" and";
//", where"
- String commaWhere = SymbolConstant.COMMA+" "+DataBaseConstant.SQL_WHERE;
+ String commaWhere = SymbolConstant.COMMA+" "+ DataBaseConstant.SQL_WHERE;
//", "
String commaSpace = SymbolConstant.COMMA + " ";
if (sql.endsWith(DataBaseConstant.SQL_WHERE) || sql.endsWith(whereSpace)) {
diff --git a/pom.xml b/pom.xml
index 867a9e14..2d974692 100644
--- a/pom.xml
+++ b/pom.xml
@@ -49,13 +49,13 @@
5.3.8
- 3.5.1
+ 3.5.3
3.2.0
1.1.22
- 1.9.1
+ 1.9.2
- 1.5.9
+ 1.6.1
2.6
2.1.0
3.11.2
@@ -63,7 +63,7 @@
1.12.0
3.11.0
3.1.0
- 1.4.3
+ 1.4.4
1.4.5
8.0.3
1.3.4
@@ -235,7 +235,7 @@
org.jeecgframework.boot
hibernate-re
- 3.5.3-beta
+ 3.5.3
@@ -317,7 +317,7 @@
org.jeecgframework
jeewx-api
- 1.5.1
+ 1.5.2
commons-beanutils