Thymeleaf 3.1

Apply the Java 21 prompt first. These rules target Thymeleaf 3.1, including its optional Spring integrations, and were checked against 3.1.5.RELEASE. Core and thymeleaf-spring5 have a Java 8 minimum; thymeleaf-spring6 requires Java 17 or later. Use Java 21 with these rules.

Template and expression trust

• Resolve org.thymeleaf:thymeleaf and the selected thymeleaf-spring5 or thymeleaf-spring6 adapter to the same release, the newest 3.1 patch, because Thymeleaf ships timely security fixes only as patches of its latest minor; inspect the resolved dependencies when a host BOM manages them. Match the adapter and Servlet namespace to the host framework.
• Render only application-controlled templates. Keep external text in model values; never concatenate it into template source, OGNL/SpEL expressions, message-expression syntax, or fragment specifications, and never evaluate a rendered value again as template code.
• Avoid __...__ preprocessing of externally influenced values, including translations and database content. Compute values in application code and bind them through ordinary expressions instead of generating expression syntax.
• Treat expression restrictions as additional protection, never as a sandbox for untrusted template authors. Restricted evaluation covers preprocessing, raw output, fragment expressions, URL bases, generic attributes, event handlers, and TEXT output; it is not a universal mode for every expression or URL parameter.
• Preserve Thymeleaf's expression restrictions and evaluation contexts. When an upgrade rejects a constructor,