RE: [xwiki-users] Instantiating arbitrary Java classes in XWiki pages

It really is forbidden to instantiate classes in Velocity. This is a bug security hole.

By this I presume that you mean that I shouldn't even have been able to use java.lang.Class.newInstance(); is this correct? brain[sic]