The list of allowed Class methods is way too restrictive in Velocity default configuration

The only thing allowed is Class#getName() (and not even the short name form...).

Things like isInstance and isAssignableFrom (as well as most of the is* methods) would also be useful and are in no way security issues.