2.3.35 - Apache FreeMarker Manual

Unsupported web browser - Use a modern browser to view this website!

- Home
- Manual
- Java API

- Contribute
- Report a Bug
- Download

Manual
Previous Next

# 2.3.35

Release date: 2026-08-23 + release process

## Changes on the FTL side

- Added support for hexadecimal literals, like `0xFF`, or `0xCAFEBABE`. See more here...

- New multi-line text built-ins, mostly useful for source code (or configuration file) generation:

  - Dedent or indent each line of a string: dedent, indent

  - Reflow text to lines of the specified maximum width: wrap

  - Split string to a sequence of lines: lines

## Changes on the Java side

- Added GraalVM native (AOT) support. But it doesn't "just work", as you have to explicitly configure reflection and resource access for your application; see more here!

- FREEMARKER-234: `BeansWrapper`, and therefore `DefaultObjectWrapper`, now exposes `isFoo()` methods that return `java.lang.Boolean` (the wrapper class) as the `foo` bean property, if you set the `incompatible_improvements` setting to 2.3.35 or higher. Earlier this only worked if the return type was primitive `boolean`, consistently with the JavaBeans specification.

- `ClassTemplateLoader` and `WebappTemplateLoader` now checks against backing out from the base directory (and throws `MalformedTemplateNameException` if that happens), instead of only relying on `TemplateCache` for that. (Note that `FileTemplateLoader` always did this check.) In principle, this is the responsibility of `TemplateCache`, however, not everyone gets `Template`-s through `Configuration.getTemplate`, and so through `TemplateCache`. While the `TemplateLoader` contract doesn't promise any such checks, it's relatively cheap to do in this case, and adds an extra layer of security.

- Removed `freemarker.debug` package entirely, because of its dependency on RMI, which often caused security scan alerts (even though it wasn't active by default). This was an old effort to support remote debugging of templates, and probably wasn't used by anyone anymore.

- Fixed issue with in XML DOM imperative XML processing, where the `@@markup` and `@@nested_markup` keys did not XML-escape the values of the `xmlns` or `xmlnx:prefix` attributes. These are URL-s, that could for example contain `&` character, and the output XML was broken earlier.

- In `freemarker.ext.dom.NodeModel` used for XML DOM wrapping, marked static utility methods as `@Deprecated`, as by default they use a `DocumentBuilderFactory` that resolved external entities, which opens the possibility of XXE attacks. While this was documented, it was easy to miss, and now the deprecation marking draws attention to it.

- Improved `DefaultMemberAccessPolicy-rules` (used by default) to block listing Java system properties. Note that no matter how much we tweak this, it will never provide proper security if you have untrusted template authors! See this in the FAQ!

- Deleted some long deprecated `main` methods (CLI entry points), and usually the entire class they were in. These are often flagged as security issues, while they were hardly ever used:

  - `freemarker.core.CommandLine` class. This was the `Main-Class` of `freemarker.jar`, and it just printed the version number.

  - `freemarker.ext.dom.Transform` class: Was a very minimalist utility to run a template with an XML document as the model

  - `freemarker.ext.jdom.NodeListModel.main` method: The even older minimalist utility to run a template with an XML document as the model. (The `freemarker.ext.jdom` package itself is also long deprecated.)

  - `freemarker.template.utility.ToCanonical` class: This has outputted the specified template files in canonical format

Previous Next