Restricted types no longer usable with th:with in 3.1.2

[wimdeblauwe]

In my book Taming Thymeleaf, I use th:with like this:

th:with="urlBuilder=${T(org.springframework.web.servlet.support.ServletUriComponentsBuilder)}"

This worked until the upgrade of Spring Boot 3.0.10 that uses Thymeleaf 3.1.2. I could not find something in the release notes that describes this change. There is #966 but that is about org.springframework.util, but this class is not in that package.

Is the behaviour of 3.1.2 intentional? Can I no longer use th:with like this?

[danielfernandez]

Unfortunately that's correct. Classes in org.springframework.web and several other packages were forbidden as a part of general security-strengthening measures in 3.1.2.

Note however that there is a #mvc expression utility object precisely related to URL building in Spring MVC applications and which might fit your needs: https://www.thymeleaf.org/doc/tutorials/3.1/thymeleafspring.html#building-uris-to-controllers

[wimdeblauwe]

I was not able to use #mvc for my use case. See https://www.wimdeblauwe.com/blog/2023/10/19/taming-thymeleaf-update-for-thymeleaf-3.1.2/ for details on how it fixed it if you are interested.