From df496873331464a2f1f9d4c595aa2ef9ffe0ee16 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Tue, 6 Oct 2026 11:08:22 +0300
Subject: [PATCH] Bump FreeMarker to 2.3.35 and fix the loadObjectClassesToMaps
 javadoc

CVE-2026-84939 (code scanning alert 1297): FreeMarker before 2.3.35
resolves a malformed locale identifier into a path outside the template
root. OpenDJ only renders its own templates, for the generated
documentation, so it is not reachable, but the jar ships in lib/.

The javadoc of CompressedSchema.loadObjectClassesToMaps listed a "sync"
parameter the method does not have and documented "mappings" twice, with
the encode and decode maps the wrong way round (alert 1281).
---
 .../main/java/org/opends/server/api/CompressedSchema.java  | 7 ++-----
 pom.xml                                                    | 2 +-
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/opendj-server-legacy/src/main/java/org/opends/server/api/CompressedSchema.java b/opendj-server-legacy/src/main/java/org/opends/server/api/CompressedSchema.java
index 702dd16753..bae38f70b7 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/api/CompressedSchema.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/api/CompressedSchema.java
@@ -949,11 +949,8 @@ protected final Map<ObjectClass, String> loadObjectClasses(
    * @param objectClassNames
    *          The user provided set of object class names.
    * @param mappings
-   *          .ocEncodeMap maps id to entry
-   * @param mappings
-   *          .ocDecodeMap maps entry to id
-   * @param sync
-   *          indicates if update of maps should be synchronized
+   *          the mappings to load into: {@code ocEncodeMap} maps the object class set to the id,
+   *          {@code ocDecodeMap} maps the id to the object class set.
    * @return The object class set.
    */
   private Map<ObjectClass, String> loadObjectClassesToMaps(int id, final Collection<String> objectClassNames,
diff --git a/pom.xml b/pom.xml
index 88f178f484..aecbdf8447 100644
--- a/pom.xml
+++ b/pom.xml
@@ -36,7 +36,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <localized.jars.classifier>i18n</localized.jars.classifier>
         <commons.version>3.2.0</commons.version>
-        <freemarker.version>2.3.34</freemarker.version>
+        <freemarker.version>2.3.35</freemarker.version>
         <metrics-core.version>4.2.30</metrics-core.version>
         <bc.fips.version>2.1.3</bc.fips.version>
         <bctls.fips.version>2.1.24</bctls.fips.version>