Submit Feedback
Legacy Knowledge Base
Published Jul. 2, 2025

Denied resolving class [...] error is shown in custom FreeMarker/Velocity templates (LSV-658)

Written By

István Gergely-Tárnoki

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • Custom FreeMarker and Velocity templates generate the following error after installing a fix pack:
    Denied resolving class [...] by org.apache

Environment

  • Liferay DXP 7.0 FP92+
  • Liferay DXP 7.1 FP18+/SP5+
  • Liferay DXP 7.2 FP6+/SP2+

Resolution

  • The behavior originates from an intentional change due to security vulnerability documented in LSV-658.
  • In Liferay DXP 7.0, 7.1, and 7.2, the template API gives users access to sensitive objects, which allows remote authenticated users to execute arbitrary code via FreeMarker and Velocity templates. Therefore certain packages that are exposed to the risk of circumventing the sandbox and achieving remote code execution were disabled in newer Fix Packs.
  • If you are using a Hotfix that requires the Fix Packs indicated above, your installation may be impacted.

  • As the Solution and Mitigation Information section states:
    • The following packages were added to the default list of Restricted Packages of the FreeMarker Engine and Velocity Engine System Settings configurations, thus if your system is using a customized version of these configurations, you have to review and update your settings accordingly. If you have custom templates relying on these restricted packages reconsider their usage before re-enabling them: 
      • com.liferay.portal.spring.context
      • com.ibm
      • io.undertow
      • org.apache
      • org.glassfish
      • org.jboss
      • org.springframework
      • org.wildfly
      • weblogic
  • You can re-enable your template by:
    1. Removing the org.apache package from the restricted packages in the Control Panel -> Configuration -> System settings -> Foundation -> Velocity Engine/FreeMarker Engine
    2. Then restart your server (or you can restart the Liferay Portal Template FreeMarker/Liferay Portal Template Velocity bundles through the App Manager).
  • However, we suggest you consider use alternatives since those packages have been disabled for security reasons.

Additional Information

  • For more information, please check LSV-658
Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?