如何保护速度模板不被篡改？
我们有一个用于收据的 Velocity 模板。 该模板包括纳税识别号，其值将在生成收据时被替换。 这是为了确保收据上打印真实许可证持有者的 TIN。
我们如何防止最终用户在模板本身中对 TIN 号码进行硬编码？ 如果 Velocity 在合并时找不到模板中的字段，有没有办法抛出异常？
We have a Velocity template for a receipt. The template includes the Tax Identification Number, the value of which will be substituted at the time of receipt generation. This is to ensure the TIN of the real license holder is printed on the receipt.
How can we prevent the end user from hardcoding the TIN number in the template itself? Is there a way for Velocity to throw an exception if it can't find a field in the template at the time of merging?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
保护模板本身可能会更好，而不是尝试让 Velocity 报告不正确的操作。 Velocity 非常能容忍缺失字段等，所以我怀疑它不会做你想要的事情。
您可以通过签名或类似方式来保护模板吗？ 这样，如果有人干扰它，应该可以立即检测到。
You may be better off by protecting the template itself, rather than by trying to get Velocity to report on incorrect operations. Velocity is pretty tolerant of missing fields etc. so I suspect it won't do what you want.
Can you protect the template by signing it or similar ? That way it should be immediately detectable if someone has interfered with it.
是否允许用户自定义模板的其他部分？
如果没有，您可以在程序中包含模板的 md5 校验和，并检查文件是否已被篡改。
但不确定这是否值得付出努力。 恶意用户还有许多其他方法可以伪造收据，您无法阻止所有这些方法。
Is the user allowed to customize other parts of the template?
If not, you could include an md5 checksum for the template in your program and check if the file has been tampered with.
Not sure if this is worth the effort, though. There are many other ways for a malicious user to fake the receipt, and you cannot stop all of them.