Update to commons-beanutils:1.9.4 without disabling the protection

core/pom.xml

@@ -44,7 +44,7 @@
     <dependency>
       <groupId>commons-beanutils</groupId>
       <artifactId>commons-beanutils</artifactId>
-      <version>1.9.2</version>
+      <version>1.9.4</version>
     </dependency>
     <dependency>
       <groupId>commons-io</groupId>

jelly/src/main/java/org/kohsuke/stapler/jelly/AttributeNameRewritingTagScript.java

@@ -0,0 +1,27 @@
+package org.kohsuke.stapler.jelly;
+
+import org.apache.commons.jelly.expression.Expression;
+import org.apache.commons.jelly.impl.TagScript;
+
+/**
+ * This class implements a {@link TagScript} that allows rewriting attribute names.
+ *
+ */
+/* package */ class AttributeNameRewritingTagScript extends TagScript {
+    private String original;
+    private final String replacement;
+
+    public AttributeNameRewritingTagScript(String original, String replacement) {
+        this.original = original;
+        this.replacement = replacement;
+    }
+
+    @Override
+    public void addAttribute(String name, Expression expression) {
+        if (original.equals(name)) {
+            super.addAttribute(replacement, expression);
+        } else {
+            super.addAttribute(name, expression);
+        }
+    }
+}

jelly/src/main/java/org/kohsuke/stapler/jelly/IncludeTag.java

@@ -34,12 +34,17 @@
 import org.xml.sax.SAXException;
 import org.jvnet.maven.jellydoc.annotation.Required;
 
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
 /**
  * Tag that includes views of the object.
  *
  * @author Kohsuke Kawaguchi
  */
 public class IncludeTag extends TagSupport {
+    public static final Logger LOGGER = Logger.getLogger(IncludeTag.class.getName());
+
     private Object it;
 
     private String page;
@@ -79,8 +84,18 @@ public void setFrom(Object from) {
      *
      * By default this is "from.getClass()". This takes
      * precedence over the {@link #setFrom(Object)} method.
+     *
+     * This used to be called {@code setClass}, but that ended up causing
+     * problems with new commons-beanutils restrictions via
+     * {@code ConvertingWrapDynaBean} use in {@code JellyBuilder}.
      */
+    public void setClazz(Class clazz) {
+        this.clazz = clazz;
+    }
+
+    @Deprecated // TODO Remove this method?
     public void setClass(Class clazz) {
+        LOGGER.log(Level.WARNING, "Unexpected call to #setClass", new Exception());
         this.clazz = clazz;
     }
 

jelly/src/main/java/org/kohsuke/stapler/jelly/StaplerTagLibrary.java

@@ -29,6 +29,7 @@
 import org.apache.commons.jelly.Script;
 import org.apache.commons.jelly.TagLibrary;
 import org.apache.commons.jelly.XMLOutput;
+import org.apache.commons.jelly.impl.DefaultTagFactory;
 import org.apache.commons.jelly.impl.TagScript;
 import org.xml.sax.Attributes;
 
@@ -105,6 +106,14 @@ public void run(JellyContext context, XMLOutput output) throws JellyTagException
                 }
             };
 
+        if (name.equals("include")) {
+            // Retain backward compatibility with all views setting the obsolete 'class' attribute.
+            // See IncludeTag#setClazz for details.
+            final AttributeNameRewritingTagScript script = new AttributeNameRewritingTagScript("class", "clazz");
+            script.setTagFactory(new DefaultTagFactory(IncludeTag.class));
+            return script;
+        }
+
         return super.createTagScript(name, attributes);
     }