It's time to upgrade Velocity... http://wiki.apache.org/velocity/Velocity15ReleaseNotes
Finally, support for nulls! And most importantly: "New, optional SecureIntrospector prohibits methods that involve manipulation of classes, classloaders or reflection objects. Use this introspector to secure Velocity against a risk of template writers using reflection to perform malicious acts." I'm going to try it out in my workspace and see what breaks. - Dave
