2.3.35

Page Contents

Release date: 2026-08-23 + release process

Changes on the FTL side

  • Added support for hexadecimal literals, like 0xFF, or 0xCAFEBABE. See more here...

  • New multi-line text built-ins, mostly useful for source code (or configuration file) generation:

    • Dedent or indent each line of a string: dedent, indent

    • Reflow text to lines of the specified maximum width: wrap

    • Split string to a sequence of lines: lines

Changes on the Java side

  • Added GraalVM native (AOT) support. But it doesn't "just work", as you have to explicitly configure reflection and resource access for your application; see more here!

  • FREEMARKER-234: BeansWrapper, and therefore DefaultObjectWrapper, now exposes isFoo() methods that return java.lang.Boolean (the wrapper class) as the foo bean property, if you set the incompatible_improvements setting to 2.3.35 or higher. Earlier this only worked if the return type was primitive boolean, consistently with the JavaBeans specification.

  • ClassTemplateLoader and WebappTemplateLoader now checks against backing out from the base directory (and throws MalformedTemplateNameException if that happens), instead of only relying on TemplateCache for that. (Note that FileTemplateLoader always did this check.) In principle, this is the responsibility of TemplateCache, however, not everyone gets Template-s through Configuration.getTemplate, and so through TemplateCache. While the TemplateLoader contract doesn't promise any such checks, it's relatively cheap to do in this case, and adds an extra layer of security.

  • Removed freemarker.debug package entirely, because of its dependency on RMI, which often caused security scan alerts (even though it wasn't active by default). This was an old effort to support remote debugging of templates, and probably wasn't used by anyone anymore.

  • Fixed issue with in XML DOM imperative XML processing, where the @@markup and @@nested_markup keys did not XML-escape the values of the xmlns or xmlnx:prefix attributes. These are URL-s, that could for example contain & character, and the output XML was broken earlier.

  • In freemarker.ext.dom.NodeModel used for XML DOM wrapping, marked static utility methods as @Deprecated, as by default they use a DocumentBuilderFactory that resolved external entities, which opens the possibility of XXE attacks. While this was documented, it was easy to miss, and now the deprecation marking draws attention to it.

  • Improved DefaultMemberAccessPolicy-rules (used by default) to block listing Java system properties. Note that no matter how much we tweak this, it will never provide proper security if you have untrusted template authors! See this in the FAQ!

  • Deleted some long deprecated main methods (CLI entry points), and usually the entire class they were in. These are often flagged as security issues, while they were hardly ever used:

    • freemarker.core.CommandLine class. This was the Main-Class of freemarker.jar, and it just printed the version number.

    • freemarker.ext.dom.Transform class: Was a very minimalist utility to run a template with an XML document as the model

    • freemarker.ext.jdom.NodeListModel.main method: The even older minimalist utility to run a template with an XML document as the model. (The freemarker.ext.jdom package itself is also long deprecated.)

    • freemarker.template.utility.ToCanonical class: This has outputted the specified template files in canonical format