The method does not validate the class name as described in the method documentation. "Validate a classname. As per SRV.9.7.2, we must restrict loading of classes from J2SE (java.*) and classes of the servlet API (javax.servlet.*) "
Created attachment 25887 [details] Minor patch to validate(name) method Minor patch to validate(name) method which returns false for javax.servlet. as described in method comment
Fixed and will be included in 7.0.3 onwards. Thanks for the patch.