Patch security hole related to Thymeleaf preprocessing; use URI builders
The following code allows RMI.

    #{__${requestParameter}__}
    
Fix: change to

    #{|${requestParameter}|}