@RomanStoffel, be extra-careful that you have no invalid entries, i.e.:
- only existing methods
- only methods reachable by “your” classloader, so in practice: only your own classes
Otherwise, an error is logged and your WHOLE allowlist-module is ignored – not just the offending entry.
See @scott.dudley’s comment #243 from 7d ago:
Look for log entries like this during plugin load:
WARN [allowlist.impl.internal.PluginAllowlistConfigurator] getModuleMethodAllowlist Invalid method(s) METHODNAME defined for class CLASSNAME- disabling Velocity Allowlist plugin module YOURMODULE