.gitignore

@@ -1 +1,2 @@
 SOURCES/velocity-1.7.tar.gz
+/velocity-1.7.tar.gz

.velocity.metadata

@@ -1 +0,0 @@
-ac76c23153cd2214591b6783f255ad210467b2f8 SOURCES/velocity-1.7.tar.gz

0001-Port-to-apache-commons-lang3.patch

@@ -1,7 +1,7 @@
-From afc1005f123933e3441833651a558ab88d7cbee4 Mon Sep 17 00:00:00 2001
+From bf0462e3c293863947dde1c22a62c3d4a187a70c Mon Sep 17 00:00:00 2001
 From: Marian Koncek <mkoncek@redhat.com>
 Date: Thu, 31 Oct 2019 14:35:40 +0100
-Subject: [PATCH] Port to apache-commons-lang3
+Subject: [PATCH 1/2] Port to apache-commons-lang3
 
 ---
  pom.xml                                                     | 6 +++---
@@ -36,10 +36,10 @@ Subject: [PATCH] Port to apache-commons-lang3
  29 files changed, 39 insertions(+), 38 deletions(-)
 
 diff --git a/pom.xml b/pom.xml
-index e2c7004..273fc9d 100644
+index 77a8e383..eee15b34 100644
 --- a/pom.xml
 +++ b/pom.xml
-@@ -143,9 +143,9 @@
+@@ -148,9 +148,9 @@
        <version>3.2.1</version>
      </dependency>
      <dependency>
@@ -53,7 +53,7 @@ index e2c7004..273fc9d 100644
      <dependency>
        <groupId>oro</groupId>
 diff --git a/src/java/org/apache/velocity/app/event/implement/EscapeHtmlReference.java b/src/java/org/apache/velocity/app/event/implement/EscapeHtmlReference.java
-index 6d98b45..e146995 100644
+index 6d98b45c..e1469957 100644
 --- a/src/java/org/apache/velocity/app/event/implement/EscapeHtmlReference.java
 +++ b/src/java/org/apache/velocity/app/event/implement/EscapeHtmlReference.java
 @@ -19,7 +19,7 @@ package org.apache.velocity.app.event.implement;
@@ -75,7 +75,7 @@ index 6d98b45..e146995 100644
  
      /**
 diff --git a/src/java/org/apache/velocity/app/event/implement/EscapeJavaScriptReference.java b/src/java/org/apache/velocity/app/event/implement/EscapeJavaScriptReference.java
-index ea49ddb..12f38f4 100644
+index ea49ddbf..12f38f47 100644
 --- a/src/java/org/apache/velocity/app/event/implement/EscapeJavaScriptReference.java
 +++ b/src/java/org/apache/velocity/app/event/implement/EscapeJavaScriptReference.java
 @@ -19,7 +19,7 @@ package org.apache.velocity.app.event.implement;
@@ -97,7 +97,7 @@ index ea49ddb..12f38f4 100644
  
      /**
 diff --git a/src/java/org/apache/velocity/app/event/implement/EscapeSqlReference.java b/src/java/org/apache/velocity/app/event/implement/EscapeSqlReference.java
-index 585cb6c..39e04f4 100644
+index 585cb6c6..39e04f43 100644
 --- a/src/java/org/apache/velocity/app/event/implement/EscapeSqlReference.java
 +++ b/src/java/org/apache/velocity/app/event/implement/EscapeSqlReference.java
 @@ -19,7 +19,7 @@ package org.apache.velocity.app.event.implement;
@@ -120,7 +120,7 @@ index 585cb6c..39e04f4 100644
  
      /**
 diff --git a/src/java/org/apache/velocity/app/event/implement/EscapeXmlReference.java b/src/java/org/apache/velocity/app/event/implement/EscapeXmlReference.java
-index 3d5b40f..fbb525c 100644
+index 3d5b40f0..fbb525cb 100644
 --- a/src/java/org/apache/velocity/app/event/implement/EscapeXmlReference.java
 +++ b/src/java/org/apache/velocity/app/event/implement/EscapeXmlReference.java
 @@ -19,7 +19,7 @@ package org.apache.velocity.app.event.implement;
@@ -133,7 +133,7 @@ index 3d5b40f..fbb525c 100644
  /**
   * Escape all XML entities.
 diff --git a/src/java/org/apache/velocity/runtime/RuntimeInstance.java b/src/java/org/apache/velocity/runtime/RuntimeInstance.java
-index bf99faa..a79d42c 100644
+index 670c083d..f877114d 100644
 --- a/src/java/org/apache/velocity/runtime/RuntimeInstance.java
 +++ b/src/java/org/apache/velocity/runtime/RuntimeInstance.java
 @@ -32,7 +32,7 @@ import java.util.Map;
@@ -146,7 +146,7 @@ index bf99faa..a79d42c 100644
  import org.apache.velocity.app.event.EventCartridge;
  import org.apache.velocity.app.event.EventHandler;
 diff --git a/src/java/org/apache/velocity/runtime/VelocimacroFactory.java b/src/java/org/apache/velocity/runtime/VelocimacroFactory.java
-index 2737b3b..956ab05 100644
+index 8756b66f..70e3d489 100644
 --- a/src/java/org/apache/velocity/runtime/VelocimacroFactory.java
 +++ b/src/java/org/apache/velocity/runtime/VelocimacroFactory.java
 @@ -26,7 +26,7 @@ import java.util.Map;
@@ -159,7 +159,7 @@ index 2737b3b..956ab05 100644
  import org.apache.velocity.exception.VelocityException;
  import org.apache.velocity.runtime.directive.Directive;
 diff --git a/src/java/org/apache/velocity/runtime/directive/Block.java b/src/java/org/apache/velocity/runtime/directive/Block.java
-index f5fdfa8..b136543 100644
+index f5fdfa85..b136543d 100755
 --- a/src/java/org/apache/velocity/runtime/directive/Block.java
 +++ b/src/java/org/apache/velocity/runtime/directive/Block.java
 @@ -23,7 +23,7 @@ import java.io.IOException;
@@ -172,7 +172,7 @@ index f5fdfa8..b136543 100644
  import org.apache.velocity.exception.TemplateInitException;
  import org.apache.velocity.runtime.Renderable;
 diff --git a/src/java/org/apache/velocity/runtime/directive/RuntimeMacro.java b/src/java/org/apache/velocity/runtime/directive/RuntimeMacro.java
-index 090b552..d22ac4e 100644
+index 090b5522..d22ac4ed 100644
 --- a/src/java/org/apache/velocity/runtime/directive/RuntimeMacro.java
 +++ b/src/java/org/apache/velocity/runtime/directive/RuntimeMacro.java
 @@ -23,7 +23,7 @@ import java.io.IOException;
@@ -185,7 +185,7 @@ index 090b552..d22ac4e 100644
  import org.apache.velocity.exception.MethodInvocationException;
  import org.apache.velocity.exception.ParseErrorException;
 diff --git a/src/java/org/apache/velocity/runtime/parser/Parser.java b/src/java/org/apache/velocity/runtime/parser/Parser.java
-index 085e7a4..62dfe48 100644
+index 1253381f..b8e7112e 100644
 --- a/src/java/org/apache/velocity/runtime/parser/Parser.java
 +++ b/src/java/org/apache/velocity/runtime/parser/Parser.java
 @@ -10,7 +10,7 @@ import org.apache.velocity.runtime.directive.Directive;
@@ -198,7 +198,7 @@ index 085e7a4..62dfe48 100644
  
  /**
 diff --git a/src/java/org/apache/velocity/runtime/parser/ParserTokenManager.java b/src/java/org/apache/velocity/runtime/parser/ParserTokenManager.java
-index ce00d99..9563a1f 100644
+index ce00d99d..9563a1fb 100644
 --- a/src/java/org/apache/velocity/runtime/parser/ParserTokenManager.java
 +++ b/src/java/org/apache/velocity/runtime/parser/ParserTokenManager.java
 @@ -9,7 +9,7 @@ import org.apache.velocity.runtime.directive.Directive;
@@ -211,7 +211,7 @@ index ce00d99..9563a1f 100644
  
  /** Token Manager. */
 diff --git a/src/java/org/apache/velocity/runtime/parser/node/ASTDirective.java b/src/java/org/apache/velocity/runtime/parser/node/ASTDirective.java
-index 86e86b7..f1ab78d 100644
+index 74727729..8fc59737 100644
 --- a/src/java/org/apache/velocity/runtime/parser/node/ASTDirective.java
 +++ b/src/java/org/apache/velocity/runtime/parser/node/ASTDirective.java
 @@ -22,7 +22,7 @@ package org.apache.velocity.runtime.parser.node;
@@ -224,7 +224,7 @@ index 86e86b7..f1ab78d 100644
  import org.apache.velocity.exception.MethodInvocationException;
  import org.apache.velocity.exception.ParseErrorException;
 diff --git a/src/java/org/apache/velocity/runtime/parser/node/ASTMethod.java b/src/java/org/apache/velocity/runtime/parser/node/ASTMethod.java
-index a1545e5..7354c9a 100644
+index 489429bb..df54dd93 100644
 --- a/src/java/org/apache/velocity/runtime/parser/node/ASTMethod.java
 +++ b/src/java/org/apache/velocity/runtime/parser/node/ASTMethod.java
 @@ -21,8 +21,8 @@ package org.apache.velocity.runtime.parser.node;
@@ -239,7 +239,7 @@ index a1545e5..7354c9a 100644
  import org.apache.velocity.context.InternalContextAdapter;
  import org.apache.velocity.exception.MethodInvocationException;
 diff --git a/src/java/org/apache/velocity/runtime/parser/node/ASTStringLiteral.java b/src/java/org/apache/velocity/runtime/parser/node/ASTStringLiteral.java
-index bb56cd9..0bc63bc 100644
+index 2267993c..82cca27a 100644
 --- a/src/java/org/apache/velocity/runtime/parser/node/ASTStringLiteral.java
 +++ b/src/java/org/apache/velocity/runtime/parser/node/ASTStringLiteral.java
 @@ -21,7 +21,7 @@ import java.io.IOException;
@@ -252,7 +252,7 @@ index bb56cd9..0bc63bc 100644
  import org.apache.velocity.exception.TemplateInitException;
  import org.apache.velocity.exception.VelocityException;
 diff --git a/src/java/org/apache/velocity/runtime/parser/node/NodeUtils.java b/src/java/org/apache/velocity/runtime/parser/node/NodeUtils.java
-index 52bcda9..8362c3e 100644
+index 713a86ae..0ac03fbc 100644
 --- a/src/java/org/apache/velocity/runtime/parser/node/NodeUtils.java
 +++ b/src/java/org/apache/velocity/runtime/parser/node/NodeUtils.java
 @@ -19,7 +19,7 @@ package org.apache.velocity.runtime.parser.node;
@@ -265,7 +265,7 @@ index 52bcda9..8362c3e 100644
  import org.apache.velocity.exception.MethodInvocationException;
  import org.apache.velocity.runtime.parser.ParserConstants;
 diff --git a/src/java/org/apache/velocity/runtime/parser/node/PropertyExecutor.java b/src/java/org/apache/velocity/runtime/parser/node/PropertyExecutor.java
-index 8c78228..20d6c18 100644
+index 8c78228e..20d6c185 100644
 --- a/src/java/org/apache/velocity/runtime/parser/node/PropertyExecutor.java
 +++ b/src/java/org/apache/velocity/runtime/parser/node/PropertyExecutor.java
 @@ -21,7 +21,7 @@ package org.apache.velocity.runtime.parser.node;
@@ -278,7 +278,7 @@ index 8c78228..20d6c18 100644
  import org.apache.velocity.runtime.RuntimeLogger;
  import org.apache.velocity.runtime.log.Log;
 diff --git a/src/java/org/apache/velocity/runtime/parser/node/SetPropertyExecutor.java b/src/java/org/apache/velocity/runtime/parser/node/SetPropertyExecutor.java
-index 0b27b45..ba5d512 100644
+index 0078d023..80887fad 100644
 --- a/src/java/org/apache/velocity/runtime/parser/node/SetPropertyExecutor.java
 +++ b/src/java/org/apache/velocity/runtime/parser/node/SetPropertyExecutor.java
 @@ -21,8 +21,8 @@ package org.apache.velocity.runtime.parser.node;
@@ -293,7 +293,7 @@ index 0b27b45..ba5d512 100644
  import org.apache.velocity.runtime.log.Log;
  import org.apache.velocity.util.introspection.Introspector;
 diff --git a/src/java/org/apache/velocity/runtime/parser/node/SimpleNode.java b/src/java/org/apache/velocity/runtime/parser/node/SimpleNode.java
-index 108846f..6372830 100644
+index 108846f8..6372830f 100644
 --- a/src/java/org/apache/velocity/runtime/parser/node/SimpleNode.java
 +++ b/src/java/org/apache/velocity/runtime/parser/node/SimpleNode.java
 @@ -22,8 +22,8 @@ package org.apache.velocity.runtime.parser.node;
@@ -308,7 +308,7 @@ index 108846f..6372830 100644
  import org.apache.velocity.exception.MethodInvocationException;
  import org.apache.velocity.exception.ParseErrorException;
 diff --git a/src/java/org/apache/velocity/runtime/resource/ResourceManagerImpl.java b/src/java/org/apache/velocity/runtime/resource/ResourceManagerImpl.java
-index 1b504eb..b33d4ed 100644
+index 778b42a9..a396e42f 100644
 --- a/src/java/org/apache/velocity/runtime/resource/ResourceManagerImpl.java
 +++ b/src/java/org/apache/velocity/runtime/resource/ResourceManagerImpl.java
 @@ -158,7 +158,7 @@ public class ResourceManagerImpl
@@ -330,7 +330,7 @@ index 1b504eb..b33d4ed 100644
                  log.warn("Declared encoding for template '" +
                               resource.getName() +
 diff --git a/src/java/org/apache/velocity/runtime/resource/loader/ClasspathResourceLoader.java b/src/java/org/apache/velocity/runtime/resource/loader/ClasspathResourceLoader.java
-index 623766f..a7cc276 100644
+index 52d09a98..bf48aa45 100644
 --- a/src/java/org/apache/velocity/runtime/resource/loader/ClasspathResourceLoader.java
 +++ b/src/java/org/apache/velocity/runtime/resource/loader/ClasspathResourceLoader.java
 @@ -22,7 +22,7 @@ package org.apache.velocity.runtime.resource.loader;
@@ -343,7 +343,7 @@ index 623766f..a7cc276 100644
  import org.apache.velocity.runtime.resource.Resource;
  import org.apache.velocity.util.ClassUtils;
 diff --git a/src/java/org/apache/velocity/runtime/resource/loader/DataSourceResourceLoader.java b/src/java/org/apache/velocity/runtime/resource/loader/DataSourceResourceLoader.java
-index 833e0ac..7414913 100644
+index f85b6d62..38ec30dc 100644
 --- a/src/java/org/apache/velocity/runtime/resource/loader/DataSourceResourceLoader.java
 +++ b/src/java/org/apache/velocity/runtime/resource/loader/DataSourceResourceLoader.java
 @@ -218,7 +218,7 @@ public class DataSourceResourceLoader extends ResourceLoader
@@ -356,7 +356,7 @@ index 833e0ac..7414913 100644
              throw new ResourceNotFoundException("DataSourceResourceLoader: Template name was empty or null");
          }
 diff --git a/src/java/org/apache/velocity/runtime/resource/loader/FileResourceLoader.java b/src/java/org/apache/velocity/runtime/resource/loader/FileResourceLoader.java
-index 462ed16..3898889 100644
+index 923274a7..8580caeb 100644
 --- a/src/java/org/apache/velocity/runtime/resource/loader/FileResourceLoader.java
 +++ b/src/java/org/apache/velocity/runtime/resource/loader/FileResourceLoader.java
 @@ -118,7 +118,7 @@ public class FileResourceLoader extends ResourceLoader
@@ -369,7 +369,7 @@ index 462ed16..3898889 100644
              /*
               * If we don't get a properly formed templateName then
 diff --git a/src/java/org/apache/velocity/runtime/resource/loader/JarResourceLoader.java b/src/java/org/apache/velocity/runtime/resource/loader/JarResourceLoader.java
-index 172384e..b7fb1a7 100644
+index 054d890e..71d6c083 100644
 --- a/src/java/org/apache/velocity/runtime/resource/loader/JarResourceLoader.java
 +++ b/src/java/org/apache/velocity/runtime/resource/loader/JarResourceLoader.java
 @@ -195,7 +195,7 @@ public class JarResourceLoader extends ResourceLoader
@@ -382,7 +382,7 @@ index 172384e..b7fb1a7 100644
              throw new ResourceNotFoundException("Need to have a resource!");
          }
 diff --git a/src/java/org/apache/velocity/runtime/resource/loader/StringResourceLoader.java b/src/java/org/apache/velocity/runtime/resource/loader/StringResourceLoader.java
-index 895182d..41c0ec9 100644
+index 245c10b8..86a08b9d 100644
 --- a/src/java/org/apache/velocity/runtime/resource/loader/StringResourceLoader.java
 +++ b/src/java/org/apache/velocity/runtime/resource/loader/StringResourceLoader.java
 @@ -26,7 +26,7 @@ import java.io.ByteArrayInputStream;
@@ -395,7 +395,7 @@ index 895182d..41c0ec9 100644
  import org.apache.velocity.exception.VelocityException;
  import org.apache.velocity.runtime.resource.Resource;
 diff --git a/src/java/org/apache/velocity/runtime/resource/loader/URLResourceLoader.java b/src/java/org/apache/velocity/runtime/resource/loader/URLResourceLoader.java
-index de06636..74ab86a 100644
+index de066367..74ab86a6 100644
 --- a/src/java/org/apache/velocity/runtime/resource/loader/URLResourceLoader.java
 +++ b/src/java/org/apache/velocity/runtime/resource/loader/URLResourceLoader.java
 @@ -26,7 +26,7 @@ import java.net.URL;
@@ -408,7 +408,7 @@ index de06636..74ab86a 100644
  import org.apache.velocity.exception.ResourceNotFoundException;
  import org.apache.velocity.runtime.resource.Resource;
 diff --git a/src/java/org/apache/velocity/util/introspection/ClassMap.java b/src/java/org/apache/velocity/util/introspection/ClassMap.java
-index 66bc7b1..77c1c8b 100644
+index 00512892..2e128b7e 100644
 --- a/src/java/org/apache/velocity/util/introspection/ClassMap.java
 +++ b/src/java/org/apache/velocity/util/introspection/ClassMap.java
 @@ -23,7 +23,7 @@ import java.lang.reflect.Method;
@@ -421,7 +421,7 @@ index 66bc7b1..77c1c8b 100644
  import org.apache.velocity.util.MapFactory;
  
 diff --git a/src/test/org/apache/velocity/io/UnicodeInputStreamTestCase.java b/src/test/org/apache/velocity/io/UnicodeInputStreamTestCase.java
-index 3142f45..ff36682 100644
+index 02499985..4b0b254f 100644
 --- a/src/test/org/apache/velocity/io/UnicodeInputStreamTestCase.java
 +++ b/src/test/org/apache/velocity/io/UnicodeInputStreamTestCase.java
 @@ -27,7 +27,7 @@ import junit.framework.Test;
@@ -434,7 +434,7 @@ index 3142f45..ff36682 100644
  
  /**
 diff --git a/src/test/org/apache/velocity/test/BaseTestCase.java b/src/test/org/apache/velocity/test/BaseTestCase.java
-index 9faf585..f893d0f 100644
+index 0ea00cbd..798a322b 100644
 --- a/src/test/org/apache/velocity/test/BaseTestCase.java
 +++ b/src/test/org/apache/velocity/test/BaseTestCase.java
 @@ -353,7 +353,7 @@ public abstract class BaseTestCase extends TestCase implements TemplateTestBase
@@ -447,7 +447,7 @@ index 9faf585..f893d0f 100644
                  buf.append('.').append(ext);
              }
 diff --git a/src/test/org/apache/velocity/test/MethodCacheKeyTestCase.java b/src/test/org/apache/velocity/test/MethodCacheKeyTestCase.java
-index d1ad1db..e70c5f2 100644
+index 77dfc54e..4befc6ef 100644
 --- a/src/test/org/apache/velocity/test/MethodCacheKeyTestCase.java
 +++ b/src/test/org/apache/velocity/test/MethodCacheKeyTestCase.java
 @@ -21,7 +21,7 @@ package org.apache.velocity.test;
@@ -460,5 +460,5 @@ index d1ad1db..e70c5f2 100644
  
  /**
 -- 
-2.21.0
+2.25.4
 

0002-Force-use-of-JDK-log-chute.patch

@@ -0,0 +1,25 @@
+From b2eee6ccc6ef24e084567a0a38d21fa3765df6ad Mon Sep 17 00:00:00 2001
+From: Mikolaj Izdebski <mizdebsk@redhat.com>
+Date: Fri, 15 May 2020 09:56:26 +0200
+Subject: [PATCH 2/2] Force use of JDK log chute
+
+---
+ .../org/apache/velocity/runtime/defaults/velocity.properties    | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/java/org/apache/velocity/runtime/defaults/velocity.properties b/src/java/org/apache/velocity/runtime/defaults/velocity.properties
+index 750a59af..855118b9 100644
+--- a/src/java/org/apache/velocity/runtime/defaults/velocity.properties
++++ b/src/java/org/apache/velocity/runtime/defaults/velocity.properties
+@@ -23,7 +23,7 @@
+ #  default LogChute to use: default: AvalonLogChute, Log4JLogChute, CommonsLogLogChute, ServletLogChute, JdkLogChute
+ # ----------------------------------------------------------------------------
+ 
+-runtime.log.logsystem.class = org.apache.velocity.runtime.log.AvalonLogChute,org.apache.velocity.runtime.log.Log4JLogChute,org.apache.velocity.runtime.log.CommonsLogLogChute,org.apache.velocity.runtime.log.ServletLogChute,org.apache.velocity.runtime.log.JdkLogChute
++runtime.log.logsystem.class = org.apache.velocity.runtime.log.JdkLogChute
+ 
+ # ---------------------------------------------------------------------------
+ # This is the location of the Velocity Runtime log.
+-- 
+2.25.4
+

0003-CVE-2020-13936.patch

@@ -0,0 +1,77 @@
+From 3be84770e7fbe6f000f0c002905e86fe1412d551 Mon Sep 17 00:00:00 2001
+From: Marian Koncek <mkoncek@redhat.com>
+Date: Thu, 11 Mar 2021 16:22:50 +0100
+Subject: [PATCH] CVE-2020-13936
+
+From upstream patches:
+https://github.com/apache/velocity-engine/commit/1ba60771d23dae7e6b3138ae6bee09cf6f9d2485
+https://github.com/apache/velocity-engine/commit/15909056fe51f5d39d49e101d706d3075876dde4
+https://github.com/apache/velocity-engine/commit/3f5d477bb4f4397bed2d2926c35dcef7de3aae3e
+
+---
+ .../velocity/runtime/defaults/velocity.properties | 15 ++++++++++-----
+ .../introspection/SecureIntrospectorImpl.java     |  9 +++++++++
+ 2 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/src/java/org/apache/velocity/runtime/defaults/velocity.properties b/src/java/org/apache/velocity/runtime/defaults/velocity.properties
+index 855118b..a8a9231 100644
+--- a/src/java/org/apache/velocity/runtime/defaults/velocity.properties
++++ b/src/java/org/apache/velocity/runtime/defaults/velocity.properties
+@@ -245,15 +245,16 @@ runtime.introspector.uberspect = org.apache.velocity.util.introspection.Uberspec
+ # accessed.
+ # ----------------------------------------------------------------------------
+ 
++# Prohibit reflection
+ introspector.restrict.packages = java.lang.reflect
+ 
+ # The two most dangerous classes
++# ClassLoader, Thread, and subclasses disabled by default in SecureIntrospectorImpl
+ 
+-introspector.restrict.classes = java.lang.Class
+-introspector.restrict.classes = java.lang.ClassLoader
+-                
+-# Restrict these for extra safety
++# Restrict these system classes.  Note that anything in this list is matched exactly.
++# (Subclasses must be explicitly named to be included).
+ 
++introspector.restrict.classes = java.lang.Class
+ introspector.restrict.classes = java.lang.Compiler
+ introspector.restrict.classes = java.lang.InheritableThreadLocal
+ introspector.restrict.classes = java.lang.Package
+@@ -262,8 +263,12 @@ introspector.restrict.classes = java.lang.Runtime
+ introspector.restrict.classes = java.lang.RuntimePermission
+ introspector.restrict.classes = java.lang.SecurityManager
+ introspector.restrict.classes = java.lang.System
+-introspector.restrict.classes = java.lang.Thread
+ introspector.restrict.classes = java.lang.ThreadGroup
+ introspector.restrict.classes = java.lang.ThreadLocal
+ 
++# Restrict instance managers for common servlet containers  (Tomcat, JBoss, Jetty)
+ 
++introspector.restrict.classes = org.apache.catalina.core.DefaultInstanceManager
++introspector.restrict.classes = org.apache.tomcat.SimpleInstanceManager
++introspector.restrict.classes = org.wildfly.extension.undertow.deployment.UndertowJSPInstanceManager
++introspector.restrict.classes = org.eclipse.jetty.util.DecoratedObjectFactory
+diff --git a/src/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java b/src/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
+index f317b1c..25fc84d 100644
+--- a/src/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
++++ b/src/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
+@@ -121,6 +121,15 @@ public class SecureIntrospectorImpl extends Introspector implements SecureIntros
+             return true;
+         }
+ 
++       /**
++       * Always disallow ClassLoader, Thread and subclasses
++       */
++        if (ClassLoader.class.isAssignableFrom(clazz) ||
++                Thread.class.isAssignableFrom(clazz))
++        {
++            return false;
++        }
++
+         /**
+          * check the classname (minus any array info)
+          * whether it matches disallowed classes or packages
+-- 
+2.29.2
+

SOURCES/0002-Port-to-OpenJDK-11.patch

@@ -1,33 +0,0 @@
-From a7d58ff8edefb992d4989a4e2d8f4eec104e4e93 Mon Sep 17 00:00:00 2001
-From: Marian Koncek <mkoncek@redhat.com>
-Date: Thu, 31 Oct 2019 15:38:55 +0100
-Subject: [PATCH] Port to OpenJDK 11
-
----
- .../org/apache/velocity/test/BuiltInEventHandlerTestCase.java | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/test/org/apache/velocity/test/BuiltInEventHandlerTestCase.java b/src/test/org/apache/velocity/test/BuiltInEventHandlerTestCase.java
-index 2005b0b..fb29ce3 100644
---- a/src/test/org/apache/velocity/test/BuiltInEventHandlerTestCase.java
-+++ b/src/test/org/apache/velocity/test/BuiltInEventHandlerTestCase.java
-@@ -339,14 +339,14 @@ public class BuiltInEventHandlerTestCase extends BaseTestCase {
-         writer = new StringWriter();
-         ve1.evaluate(context,writer,"test","$list.get(0)");
-         assertTrue(writer.toString().indexOf("IndexOutOfBoundsException") != -1);
--        assertTrue(writer.toString().indexOf("Index: 0, Size: 0") == -1);
-+        assertTrue(writer.toString().indexOf("Index 0 out of bounds for length 0") == -1);
-         assertTrue(writer.toString().indexOf("ArrayList") == -1);
- 
-         // message
-         writer = new StringWriter();
-         ve2.evaluate(context,writer,"test","$list.get(0)");
-         assertTrue(writer.toString().indexOf("IndexOutOfBoundsException") != -1);
--        assertTrue(writer.toString().indexOf("Index: 0, Size: 0") != -1);
-+        assertTrue(writer.toString().indexOf("Index 0 out of bounds for length 0") != -1);
-         assertTrue(writer.toString().indexOf("ArrayList") == -1);
- 
-         // stack trace
--- 
-2.21.0
-

gating.yaml

@@ -0,0 +1,8 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_contexts:
+  - osci_compose_gate
+rules:
+  # https://docs.engineering.redhat.com/display/RHELPLAN/Maven+Bootstrap+manual+gating+test
+  - !PassingTestCaseRule {test_case_name: manual.sst_cs_apps.maven.bootstrap}

sources

@@ -0,0 +1 @@
+SHA512 (velocity-1.7.tar.gz) = d305642aab3c837ad250deaa46b516561fb68f92d04fc205fd4f40eb774ba6286ed3b239ee6352bc4411bd11cb4d1d5b39ce9ab8467f0e1ffceed9f9fc5a228d

velocity.spec

@@ -1,7 +1,9 @@
+%bcond_without  hsqldb
 
 Name:           velocity
 Version:        1.7
-Release:        26%{?dist}
+Release:        24%{?dist}
+Epoch:          0
 Summary:        Java-based template engine
 License:        ASL 2.0
 URL:            http://velocity.apache.org/
@@ -21,17 +23,18 @@ Patch4:         0001-Don-t-use-Werken-XPath.patch
 Patch5:         0006-Skip-Java-8-incompatible-test.patch
 Patch6:         velocity-1.7-doclint.patch
 Patch7:         velocity-1.7-osgi.patch
-Patch8:         0001-Port-to-apache-commons-lang3.patch
-Patch9:         0002-Port-to-OpenJDK-11.patch
 
 BuildRequires:  javapackages-local
 BuildRequires:  ant
 BuildRequires:  antlr
 BuildRequires:  junit
 BuildRequires:  ant-junit
+%if %{with hsqldb}
+BuildRequires:  hsqldb-lib
+%endif
 BuildRequires:  apache-commons-collections
 BuildRequires:  apache-commons-logging
-BuildRequires:  apache-commons-lang3
+BuildRequires:  apache-commons-lang
 BuildRequires:  glassfish-servlet-api
 BuildRequires:  jakarta-oro
 BuildRequires:  jaxen
@@ -78,7 +81,7 @@ Javadoc for %{name}.
 
 %package        demo
 Summary:        Demo for %{name}
-Requires:       %{name} = %{version}-%{release}
+Requires:       %{name} = %{epoch}:%{version}-%{release}
 
 %description    demo
 Demonstrations and samples for %{name}.
@@ -129,13 +132,9 @@ cp %{SOURCE1} ./pom.xml
 # Remove werken-xpath Import/Export refences in OSGi manifest file
 %patch7 -p1
 
-# Port to apache-commons-lang3
+%if %{without hsqldb}
-%patch8 -p1
-
-# Tests compare the string content of thrown exceptions which changed with jdk 11
-%patch9 -p1
-
 rm -r src/test/org/apache/velocity/test/sql
+%endif
 
 # -----------------------------------------------------------------------------
 
@@ -144,7 +143,7 @@ rm -r src/test/org/apache/velocity/test/sql
 export CLASSPATH=$(build-classpath \
 antlr \
 apache-commons-collections \
-commons-lang3 \
+commons-lang \
 commons-logging \
 glassfish-servlet-api \
 junit \
@@ -196,12 +195,6 @@ cp -pr examples test %{buildroot}%{_datadir}/%{name}
 %{_datadir}/%{name}
 
 %changelog
-* Tue Nov 05 2019 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.7-26
-- Mass rebuild for javapackages-tools 201902
-
-* Fri May 24 2019 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.7-25
-- Mass rebuild for javapackages-tools 201901
-
 * Tue Jul 31 2018 Michael Simacek <msimacek@redhat.com> - 0:1.7-24
 - Repack the tarball without binaries