title: Avoid java package 'freemarker' to excute
body: <p>I am using freemaker as my template engine.
  I have a security issue with it that I am not sure how to handle:
  admin users are able to modify the templates, 
  but in case they will set an input like:</p>
  
  <pre><code>`&lt;#assign ex = "freemarker.template.utility.Execute"?new()&gt;${ ex("pwd")}`.
  </code></pre>
  
  <p>Then the code will call:</p>
  
  <p><code>freemarker.core.Environment.process()</code></p>
  
  <p>The command "pwd" will be executed. How can I avoid it?</p>