Merge commit from fork

Restrict property accessing to disallow fetching properties from restricted bases

Author: jasmith-hs

src/main/java/com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java

@@ -79,6 +79,9 @@ public Class<?> getType(ELContext context, Object base, Object property) {
 
   @Override
   public Object getValue(ELContext context, Object base, Object property) {
+    if (isRestrictedClass(base)) {
+      return null;
+    }
     Object result = super.getValue(context, base, validatePropertyName(property));
     return result instanceof Class ? null : result;
   }

src/test/java/com/hubspot/jinjava/el/ext/JinjavaBeanELResolverTest.java

@@ -8,6 +8,7 @@
 import com.google.common.collect.ImmutableSet;
 import com.hubspot.jinjava.JinjavaConfig;
 import com.hubspot.jinjava.el.JinjavaELContext;
+import com.hubspot.jinjava.interpret.AutoCloseableSupplier;
 import com.hubspot.jinjava.interpret.JinjavaInterpreter;
 import javax.el.ELContext;
 import javax.el.MethodNotFoundException;
@@ -173,4 +174,16 @@ public void itThrowsExceptionWhenPropertyIsRestrictedFromConfig() {
       .hasMessageStartingWith("Could not find property");
     JinjavaInterpreter.popCurrent();
   }
+
+  @Test
+  public void itDoesNotAllowAccessingPropertiesOfInterpreter() {
+    try (
+      AutoCloseableSupplier.AutoCloseableImpl<JinjavaInterpreter> c = JinjavaInterpreter
+        .closeablePushCurrent(interpreter)
+        .get()
+    ) {
+      assertThat(jinjavaBeanELResolver.getValue(elContext, interpreter, "config"))
+        .isNull();
+    }
+  }
 }

src/test/java/com/hubspot/jinjava/interpret/JinjavaInterpreterTest.java

@@ -600,4 +600,10 @@ public void itOutputsUndefinedVariableError() {
     assertThat(outputtingErrorInterpreters.getErrors().get(0).getCategoryErrors())
       .isEqualTo(ImmutableMap.of("variable", "bar"));
   }
+
+  @Test
+  public void itDoesNotAllowAccessingPropertiesOfInterpreter() {
+    assertThat(jinjava.render("{{ ____int3rpr3t3r____.config }}", new HashMap<>()))
+      .isEqualTo("");
+  }
 }