Package fr.becpg.repo.template.impl

Class TemplateLookupLocale

java.lang.Object

fr.becpg.repo.template.impl.TemplateLookupLocale

public final class TemplateLookupLocale
extends Object

Reduces a locale to the part FreeMarker may safely append to a template name.

With localized lookup on, FreeMarker builds the name of the template to load from Locale.toString(). A locale parsed from an Accept-Language header can carry an arbitrary variant such as /../../x, which turns the lookup into a path traversal (CVE-2026-84939, fixed in FreeMarker 2.3.35). Only a well-formed language and country are kept: no shipped template is localized by script or variant.

Version:

$Id: $Id

Author:

matthieu

Field Summary

Fields

Modifier and Type	Field	Description
private static final Pattern	COUNTRY_PATTERN
private static final Pattern	LANGUAGE_PATTERN

Constructor Summary

Constructors

Modifier	Constructor	Description
private	TemplateLookupLocale()

Method Summary

Modifier and Type	Method	Description
static Locale	sanitize(Locale locale)	Returns the locale to hand to FreeMarker for a localized lookup.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LANGUAGE_PATTERN

private static final Pattern LANGUAGE_PATTERN

COUNTRY_PATTERN

private static final Pattern COUNTRY_PATTERN

Constructor Details

TemplateLookupLocale

private TemplateLookupLocale()

Method Details

sanitize

public static Locale sanitize(Locale locale)

Returns the locale to hand to FreeMarker for a localized lookup.

Parameters:

locale - the requested locale, may be null

Returns:

the language and country of the locale when they are well-formed, the language alone when only the country is malformed, Locale.ROOT otherwise