Active Objects not working in Jira 9.0.0 Velocity Templates

Hi everyone,
I updated our Jira Version from 8.16.1 to 9.0 and it caused problems with Active Objects in Velocity templates. Before I was just transferring a list of Active Objects as context parameter and iterating through it with a for each loop in the template:

        #foreach($config in $configs)
            <td><input type="submit" class="delete-config" data-id="$config.getID()" name="submit" value="Delete"/></td>
            <td><a href="config?actionType=edit&id=$config.getID()" class="edit-config">Edit</a></td>

The issue is now that it doesn’t get rendered with the new Jira Version anymore, while it works fine with the previous version.

I currently use a workaround where I’m transferring every value in a separate String list to avoid Active Objects, but I really would prefer a “cleaner” solution.

Hi @CarolineW,

Looking at other posts, it seems there has been a change to not allow AO to be used directly in a Velocity template. Some comments include

And it’s likely the workaround documented here explains what happened

these changes were made in order to limit potential template injection vulnerabilities