Narrows class resolver

Author: lukaszlenart

core/src/main/java/org/apache/struts2/views/freemarker/FreemarkerManager.java

@@ -28,6 +28,7 @@
 import com.opensymphony.xwork2.util.ClassLoaderUtil;
 import com.opensymphony.xwork2.util.ValueStack;
 import freemarker.cache.*;
+import freemarker.core.TemplateClassResolver;
 import freemarker.ext.jsp.TaglibFactory;
 import freemarker.ext.servlet.HttpRequestHashModel;
 import freemarker.ext.servlet.HttpRequestParametersHashModel;
@@ -318,16 +319,23 @@ protected Configuration createConfiguration(ServletContext servletContext) throw
         configuration.setTemplateExceptionHandler(TemplateExceptionHandler.HTML_DEBUG_HANDLER);
 
         if (mruMaxStrongSize > 0) {
+            LOG.debug("Sets Configuration.CACHE_STORAGE_KEY to strong:{}", mruMaxStrongSize);
             configuration.setSetting(Configuration.CACHE_STORAGE_KEY, "strong:" + mruMaxStrongSize);
         }
         if (templateUpdateDelay != null) {
+            LOG.debug("Sets Configuration.TEMPLATE_UPDATE_DELAY_KEY to {}", templateUpdateDelay);
             configuration.setSetting(Configuration.TEMPLATE_UPDATE_DELAY_KEY, templateUpdateDelay);
         }
         if (encoding != null) {
+            LOG.debug("Sets DefaultEncoding to {}", encoding);
             configuration.setDefaultEncoding(encoding);
         }
+        LOG.debug("Disabled localized lookups");
         configuration.setLocalizedLookup(false);
+        LOG.debug("Enabled whitespace stripping");
         configuration.setWhitespaceStripping(true);
+        LOG.debug("Sets NewBuiltinClassResolver to TemplateClassResolver.SAFER_RESOLVER");
+        configuration.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
 
         return configuration;
     }