using Velocity to externalize configuration properties ?

[Brent Putman]

On 8/1/13 9:47 PM, Cantor, Scott wrote:
> The real failing is that they have not prevented remote lookup. That's the
> underlying bug I'd like to fix. It may be that it isn't done under
> ordinary use and we're causing it to do that, but it should never even
> try, for security and reliability reasons.

Yes, it would be nice to absolutely turn that off.  Actually, I've never
even looked.  Maybe they have something, I honestly don't know.  Even if
they do, I'm sure you'd say remote resolution should be off by default,
and I'd agree.

I know you also don't like their use of xsi:schemaLocation, upon which
their catalog-ish mechanism is based.  Hopefully we can customize all of
that.

>
> I did look into possibly trying to inject an EntityResolver, but I didn't
> pursue it to the point of trying it.

I know we already do that for our custom parsing, but you probably mean
for their default parsing of everything (e.g. plain beans schema files)
.  I don't know whether or how that's possible, but they definitely have
lots of knobs for other things, so I wouldn't be surprised it something
could be done there.