This file is indexed.

/etc/velocity/velocity.properties is in velocity 1.7-4.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.    

# ----------------------------------------------------------------------------
# R U N T I M E  L O G
# ----------------------------------------------------------------------------

# ----------------------------------------------------------------------------
#  default LogChute to use: default: AvalonLogChute, Log4JLogChute, CommonsLogLogChute, ServletLogChute, JdkLogChute
# ----------------------------------------------------------------------------

runtime.log.logsystem.class = org.apache.velocity.runtime.log.AvalonLogChute,org.apache.velocity.runtime.log.Log4JLogChute,org.apache.velocity.runtime.log.CommonsLogLogChute,org.apache.velocity.runtime.log.ServletLogChute,org.apache.velocity.runtime.log.JdkLogChute

# ---------------------------------------------------------------------------
# This is the location of the Velocity Runtime log.
# ----------------------------------------------------------------------------

runtime.log = velocity.log

# ----------------------------------------------------------------------------
# This controls whether invalid references are logged.
# ----------------------------------------------------------------------------

runtime.log.invalid.references = true

# ----------------------------------------------------------------------------
# T E M P L A T E  E N C O D I N G
# ----------------------------------------------------------------------------

input.encoding=ISO-8859-1
output.encoding=ISO-8859-1

# ----------------------------------------------------------------------------
# F O R E A C H  P R O P E R T I E S
# ----------------------------------------------------------------------------
# These properties control how the counter is accessed in the #foreach
# directive. By default the reference $velocityCount and $velocityHasNext
# will be available in the body of the #foreach directive.
# The default starting value for $velocityCount is 1.
# ----------------------------------------------------------------------------

directive.foreach.counter.name = velocityCount
directive.foreach.counter.initial.value = 1
directive.foreach.maxloops = -1

directive.foreach.iterator.name = velocityHasNext

# ----------------------------------------------------------------------------
# S E T  P R O P E R T I E S
# ----------------------------------------------------------------------------
# These properties control the behavior of #set.
# For compatibility, the default behavior is to disallow setting a reference
# to null.  This default may be changed in a future version.
# ----------------------------------------------------------------------------

directive.set.null.allowed = false

# ----------------------------------------------------------------------------
# I F  P R O P E R T I E S
# ----------------------------------------------------------------------------
# These properties control the behavior of #if
# Default behavior is to check return value of toString() and treat an object
# with toString() that returns null as null. If all objects have toString()
# methods that never return null, this check is unnecessary and can be disabled
# to gain performance. In Velocity 1.5, no such null check was performed.
directive.if.tostring.nullcheck = true

# ----------------------------------------------------------------------------
# I N C L U D E  P R O P E R T I E S
# ----------------------------------------------------------------------------
# These are the properties that governed the way #include'd content
# is governed.
# ----------------------------------------------------------------------------

directive.include.output.errormsg.start = <!-- include error :
directive.include.output.errormsg.end   =  see error log -->

# ----------------------------------------------------------------------------
# P A R S E  P R O P E R T I E S
# ----------------------------------------------------------------------------

directive.parse.max.depth = 10

# ----------------------------------------------------------------------------
# S C O P E  P R O P E R T I E S
# ----------------------------------------------------------------------------
# These are the properties that govern whether or not a Scope object
# is automatically provided for each of the given scopes to serve as a
# scope-safe reference namespace and "label" for #break calls. The default
# for most of these is false.  Note that <bodymacroname> should be replaced by
# name of macros that take bodies for which you want to suppress the scope.
# ----------------------------------------------------------------------------
# template.provide.scope.control = false
# evaluate.provide.scope.control = false
foreach.provide.scope.control = true
# macro.provide.scope.control = false
# define.provide.scope.control = false
# <bodymacroname>.provide.scope.control = false

# ----------------------------------------------------------------------------
# T E M P L A T E  L O A D E R S
# ----------------------------------------------------------------------------
#
#
# ----------------------------------------------------------------------------

resource.loader = file

file.resource.loader.description = Velocity File Resource Loader
file.resource.loader.class = org.apache.velocity.runtime.resource.loader.FileResourceLoader
file.resource.loader.path = .
file.resource.loader.cache = false
file.resource.loader.modificationCheckInterval = 2

string.resource.loader.description = Velocity String Resource Loader
string.resource.loader.class = org.apache.velocity.runtime.resource.loader.StringResourceLoader

# ----------------------------------------------------------------------------
# VELOCIMACRO PROPERTIES
# ----------------------------------------------------------------------------
# global : name of default global library.  It is expected to be in the regular
# template path.  You may remove it (either the file or this property) if
# you wish with no harm.
# ----------------------------------------------------------------------------
# velocimacro.library = VM_global_library.vm

velocimacro.permissions.allow.inline = true
velocimacro.permissions.allow.inline.to.replace.global = false
velocimacro.permissions.allow.inline.local.scope = false

velocimacro.context.localscope = false
velocimacro.max.depth = 20

# ----------------------------------------------------------------------------
# VELOCIMACRO STRICT MODE
# ----------------------------------------------------------------------------
# if true, will throw an exception for incorrect number 
# of arguments.  false by default (for backwards compatibility)
# but this option will eventually be removed and will always
# act as if true
# ----------------------------------------------------------------------------
velocimacro.arguments.strict = false

# ----------------------------------------------------------------------------
# VELOCIMACRO BODY REFERENCE 
# ----------------------------------------------------------------------------
# Defines name of the reference that can be used to render the AST block passed to
# block macro call as an argument inside a macro.
# ----------------------------------------------------------------------------
velocimacro.body.reference=bodyContent

# ----------------------------------------------------------------------------
# STRICT REFERENCE MODE
# ----------------------------------------------------------------------------
# if true, will throw a MethodInvocationException for references
# that are not defined in the context, or have not been defined
# with a #set directive. This setting will also throw an exception
# if an attempt is made to call a non-existing property on an object
# or if the object is null.  When this property is true then property
# 'directive.set.null.allowed' is also set to true.
# ----------------------------------------------------------------------------
runtime.references.strict = false

# ----------------------------------------------------------------------------
# INTERPOLATION
# ----------------------------------------------------------------------------
# turn off and on interpolation of references and directives in string
# literals.  ON by default :)
# ----------------------------------------------------------------------------
runtime.interpolate.string.literals = true


# ----------------------------------------------------------------------------
# RESOURCE MANAGEMENT
# ----------------------------------------------------------------------------
# Allows alternative ResourceManager and ResourceCache implementations
# to be plugged in.
# ----------------------------------------------------------------------------
resource.manager.class = org.apache.velocity.runtime.resource.ResourceManagerImpl
resource.manager.cache.class = org.apache.velocity.runtime.resource.ResourceCacheImpl

# ----------------------------------------------------------------------------
# PARSER POOL
# ----------------------------------------------------------------------------
# Selects a custom factory class for the parser pool.  Must implement
# ParserPool.  parser.pool.size is used by the default implementation
# ParserPoolImpl
# ----------------------------------------------------------------------------

parser.pool.class = org.apache.velocity.runtime.ParserPoolImpl
parser.pool.size = 20


# ----------------------------------------------------------------------------
# EVENT HANDLER
# ----------------------------------------------------------------------------
# Allows alternative event handlers to be plugged in.  Note that each
# class property is actually a comma-separated list of classes (which will
# be called in order).
# ----------------------------------------------------------------------------
# eventhandler.referenceinsertion.class =
# eventhandler.nullset.class =
# eventhandler.methodexception.class =
# eventhandler.include.class =


# ----------------------------------------------------------------------------
# EVALUATE
# ----------------------------------------------------------------------------
# Evaluate VTL dynamically in template.  Select a class for the Context, if
# you want all #set calls within it to be locally scoped.  This feature is
# deprecated; please use $evaluate to hold local references instead.
# ----------------------------------------------------------------------------

#directive.evaluate.context.class = org.apache.velocity.VelocityContext


# ----------------------------------------------------------------------------
# PLUGGABLE INTROSPECTOR
# ----------------------------------------------------------------------------
# Allows alternative introspection and all that can of worms brings.
# ----------------------------------------------------------------------------

runtime.introspector.uberspect = org.apache.velocity.util.introspection.UberspectImpl


# ----------------------------------------------------------------------------
# SECURE INTROSPECTOR
# ----------------------------------------------------------------------------
# If selected, prohibits methods in certain classes and packages from being 
# accessed.
# ----------------------------------------------------------------------------

introspector.restrict.packages = java.lang.reflect

# The two most dangerous classes

introspector.restrict.classes = java.lang.Class
introspector.restrict.classes = java.lang.ClassLoader
                
# Restrict these for extra safety

introspector.restrict.classes = java.lang.Compiler
introspector.restrict.classes = java.lang.InheritableThreadLocal
introspector.restrict.classes = java.lang.Package
introspector.restrict.classes = java.lang.Process
introspector.restrict.classes = java.lang.Runtime
introspector.restrict.classes = java.lang.RuntimePermission
introspector.restrict.classes = java.lang.SecurityManager
introspector.restrict.classes = java.lang.System
introspector.restrict.classes = java.lang.Thread
introspector.restrict.classes = java.lang.ThreadGroup
introspector.restrict.classes = java.lang.ThreadLocal