On 3/6/07, THOMAS, BRIAN M (ATTSI) <bt0008@att.com> wrote:

> It really is forbidden to instantiate classes in Velocity. This is a
> bug security hole.

By this I presume that you mean that I shouldn't even have been able to
use java.lang.Class.newInstance (); is this correct?

Not since yesterday (1.0 beta5 release). Up to beta4, yes, you could have done it.

brain[sic]