From 9fb614a5c60bf6f269edee6b69e543d8ca6af1c3 Mon Sep 17 00:00:00 2001 From: Arjen Poutsma Date: Wed, 25 Mar 2020 14:58:18 +0100 Subject: [PATCH] Clarify the role of views with Spring MVC This commit adds a section to the reference docs that explains views live within the trust boundary of the application, and the security implications thereof. Closes gh-24777 --- src/docs/asciidoc/web/webmvc-view.adoc | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/docs/asciidoc/web/webmvc-view.adoc b/src/docs/asciidoc/web/webmvc-view.adoc index 2856ea3b2b..73b61e8f11 100644 --- a/src/docs/asciidoc/web/webmvc-view.adoc +++ b/src/docs/asciidoc/web/webmvc-view.adoc @@ -7,8 +7,11 @@ Thymeleaf, Groovy Markup Templates, JSPs, or other technologies, is primarily a of a configuration change. This chapter covers view technologies integrated with Spring MVC. We assume you are already familiar with <>. - - +WARNING: The views of a Spring MVC application live within the internal trust boundaries of that +application. +Views have access to all the beans of your application context. +As such, it is not recommended to use Spring MVC's template support in applications where the +templates are editable by external sources, since this can have security implications. [[mvc-view-thymeleaf]] == Thymeleaf