Set comma separated list of the only classes javascript templates are allowed to use via Java.type(...).
By default javascript templates cannot use any Java class at all. Everything else in a template still works — the full modern JavaScript standard library is available — but Java.type(...) and the java.* globals resolve nothing until you list the classes you want here. This is deliberate: a template that can reach java.lang.Runtime can run OS commands inside the MockServer process, so anyone able to register an expectation could run code on your machine.
If one of your templates needs a Java class, add just that class (or its package). Setting this to * lets templates resolve any class again — only do that when every template you render comes from a source you fully trust.
When set, this takes precedence over javascriptDisallowedClasses. Entries match a class name exactly, or match a whole package when they end in .* (for example java.util.*).
Type: string Default: "" (no Java classes can be used)
Java Code:
ConfigurationProperties.javascriptAllowedClasses(String javascriptAllowedClasses)System Property:
-Dmockserver.javascriptAllowedClasses=...Environment Variable:
MOCKSERVER_JAVASCRIPT_ALLOWED_CLASSES=...Property File:
mockserver.javascriptAllowedClasses=...Example:
-Dmockserver.javascriptAllowedClasses="java.util.*,java.time.Instant"Set comma separate list of classes not allowed to be used by javascript templates
Setting this widens the default: instead of "no Java class can be used", templates may then use every class except the ones you list here. That is weaker protection, because a list of banned classes can never be complete — banning java.lang.Runtime still leaves java.lang.ProcessBuilder, and a template can reach other classes indirectly. Prefer javascriptAllowedClasses above, or leave both unset.
Type: string Default: ""
Java Code:
ConfigurationProperties.javascriptDisallowedClasses(String javascriptDisallowedClasses)System Property:
-Dmockserver.javascriptDisallowedClasses=...Environment Variable:
MOCKSERVER_JAVASCRIPT_DISALLOWED_CLASSES=...Property File:
mockserver.javascriptDisallowedClasses=...Example:
-Dmockserver.javascriptDisallowedClasses="java.lang.Runtime,java.lang.Class"Set comma separate list of text not allowed to be contained in javascript templates
Type: string Default: ""
Java Code:
ConfigurationProperties.javascriptDisallowedText(String javascriptDisallowedText)System Property:
-Dmockserver.javascriptDisallowedText=...Environment Variable:
MOCKSERVER_JAVASCRIPT_DISALLOWED_TEXT=...Property File:
mockserver.javascriptDisallowedText=...Example:
-Dmockserver.javascriptDisallowedText="getRuntime().exec"Maximum time in milliseconds a JavaScript response template is allowed to run before it is cancelled. A runaway or malicious template (for example one containing an infinite loop) would otherwise pin the worker thread handling that request indefinitely; this cap aborts the evaluation with a clear timeout error instead, so the request fails fast and the thread is freed.
The default of 5000 (5 seconds) is far longer than any legitimate template needs — a normal template evaluates in well under a second — so it will not affect real templates. Increase it only if you run unusually heavy templates, or set it to 0 (or a negative value) to disable the timeout entirely and restore the previous unbounded behaviour.
Type: long Default: 5000
Java Code:
ConfigurationProperties.javascriptTemplateExecutionTimeout(long millis)System Property:
-Dmockserver.javascriptTemplateExecutionTimeout=...Environment Variable:
MOCKSERVER_JAVASCRIPT_TEMPLATE_EXECUTION_TIMEOUT=...Property File:
mockserver.javascriptTemplateExecutionTimeout=...Example:
-Dmockserver.javascriptTemplateExecutionTimeout="2000"If true class loading is not allowed in velocity templates
This is on by default, so a velocity template cannot load Java classes (for example through $request.class.classLoader.loadClass(...)). That matters because a template that can load java.lang.Runtime can run OS commands inside the MockServer process, so anyone able to register an expectation could run code on your machine. Ordinary templates — values from the request, the built-in $uuid/$now/$faker helpers, the $json/$xml/$math tools — are unaffected.
Set it to false only if one of your templates genuinely needs to load classes, and only when every template you render comes from a source you fully trust.
Type: boolean Default: true
Java Code:
ConfigurationProperties.velocityDisallowClassLoading(boolean velocityDisallowClassLoading)System Property:
-Dmockserver.velocityDisallowClassLoading=...Environment Variable:
MOCKSERVER_VELOCITY_DISALLOW_CLASS_LOADING=...Property File:
mockserver.velocityDisallowClassLoading=...Example:
-Dmockserver.velocityDisallowClassLoading="true"Set comma separate list of text not allowed to be contained in velocity templates
Type: string Default: ""
Java Code:
ConfigurationProperties.velocityDisallowedText(String velocityDisallowedText)System Property:
-Dmockserver.velocityDisallowedText=...Environment Variable:
MOCKSERVER_VELOCITY_DISALLOWED_TEXT=...Property File:
mockserver.velocityDisallowedText=...Example:
-Dmockserver.velocityDisallowedText="request.class"Set comma separate list of text not allowed to be contained in mustache templates
Type: string Default: ""
Java Code:
ConfigurationProperties.mustacheDisallowedText(String mustacheDisallowedText)System Property:
-Dmockserver.mustacheDisallowedText=...Environment Variable:
MOCKSERVER_MUSTACHE_DISALLOWED_TEXT=...Property File:
mockserver.mustacheDisallowedText=...Example:
-Dmockserver.mustacheDisallowedText="request.method"Seed for the template faker sample-data helper (Velocity $faker, Mustache {% raw %}{{faker.*}}{% endraw %}, JavaScript faker). By default faker is unseeded, so faker-driven templates produce different, random values on every render.
Set a non-zero value to seed faker deterministically so faker-driven templates generate reproducible fixtures across runs — useful when you want your generated test data to be stable from one run to the next. The seed produces a deterministic sequence of values for a given order of renders; determinism is strongest when fixtures are generated sequentially.
The default of 0 leaves faker unseeded, so existing templates are unaffected.
Type: long Default: 0
Java Code:
ConfigurationProperties.templateFakerSeed(long seed)System Property:
-Dmockserver.templateFakerSeed=...Environment Variable:
MOCKSERVER_TEMPLATE_FAKER_SEED=...Property File:
mockserver.templateFakerSeed=...Example:
-Dmockserver.templateFakerSeed="42"