Commit upstream/1.4.11.1 - libxstream-java

+12

-12

pom.xml less more

13	13	<groupId>com.thoughtworks.xstream</groupId>
14	14	<artifactId>xstream-parent</artifactId>
15	15	<packaging>pom</packaging>
16		<version>1.4.11</version>
	16	<version>1.4.11.1</version>
17	17	<name>XStream Parent</name>
18	18	<url>http://x-stream.github.io</url>
19	19	<description>

320	320	<dependency>
321	321	<groupId>com.thoughtworks.xstream</groupId>
322	322	<artifactId>xstream</artifactId>
323		<version>1.4.11</version>
	323	<version>1.4.11.1</version>
324	324	</dependency>
325	325	<dependency>
326	326	<groupId>com.thoughtworks.xstream</groupId>
327	327	<artifactId>xstream</artifactId>
328		<version>1.4.11</version>
	328	<version>1.4.11.1</version>
329	329	<classifier>tests</classifier>
330	330	<type>test-jar</type>
331	331	<scope>test</scope>

333	333	<dependency>
334	334	<groupId>com.thoughtworks.xstream</groupId>
335	335	<artifactId>xstream</artifactId>
336		<version>1.4.11</version>
	336	<version>1.4.11.1</version>
337	337	<classifier>javadoc</classifier>
338	338	<scope>provided</scope>
339	339	</dependency>
340	340	<dependency>
341	341	<groupId>com.thoughtworks.xstream</groupId>
342	342	<artifactId>xstream-hibernate</artifactId>
343		<version>1.4.11</version>
	343	<version>1.4.11.1</version>
344	344	</dependency>
345	345	<dependency>
346	346	<groupId>com.thoughtworks.xstream</groupId>
347	347	<artifactId>xstream-hibernate</artifactId>
348		<version>1.4.11</version>
	348	<version>1.4.11.1</version>
349	349	<classifier>javadoc</classifier>
350	350	<scope>provided</scope>
351	351	</dependency>
352	352	<dependency>
353	353	<groupId>com.thoughtworks.xstream</groupId>
354	354	<artifactId>xstream-jmh</artifactId>
355		<version>1.4.11</version>
	355	<version>1.4.11.1</version>
356	356	</dependency>
357	357	<dependency>
358	358	<groupId>com.thoughtworks.xstream</groupId>
359	359	<artifactId>xstream-jmh</artifactId>
360		<version>1.4.11</version>
	360	<version>1.4.11.1</version>
361	361	<classifier>javadoc</classifier>
362	362	<scope>provided</scope>
363	363	</dependency>
364	364	<dependency>
365	365	<groupId>com.thoughtworks.xstream</groupId>
366	366	<artifactId>xstream-benchmark</artifactId>
367		<version>1.4.11</version>
	367	<version>1.4.11.1</version>
368	368	</dependency>
369	369	<dependency>
370	370	<groupId>com.thoughtworks.xstream</groupId>
371	371	<artifactId>xstream-benchmark</artifactId>
372		<version>1.4.11</version>
	372	<version>1.4.11.1</version>
373	373	<classifier>javadoc</classifier>
374	374	<scope>provided</scope>
375	375	</dependency>

920	920	<distributionManagement>
921	921	<repository>
922	922	<id>ossrh-staging</id>
923		<url>http://oss.sonatype.org/service/local/staging/deploy/maven2</url>
	923	<url>https://oss.sonatype.org/service/local/staging/deploy/maven2</url>
924	924	</repository>
925	925	<snapshotRepository>
926	926	<id>ossrh-snapshots</id>
927		<url>http://oss.sonatype.org/content/repositories/snapshots</url>
	927	<url>https://oss.sonatype.org/content/repositories/snapshots</url>
928	928	</snapshotRepository>
929	929	<!--site>
930	930	<id>github</id>

+1

-1

xstream/pom.xml less more

13	13	<parent>
14	14	<groupId>com.thoughtworks.xstream</groupId>
15	15	<artifactId>xstream-parent</artifactId>
16		<version>1.4.11</version>
	16	<version>1.4.11.1</version>
17	17	</parent>
18	18	<artifactId>xstream</artifactId>
19	19	<packaging>jar</packaging>

+1

-0

xstream/src/java/com/thoughtworks/xstream/core/JVM.java less more

185	185	try {
186	186	base64 = (StringCodec)base64Class.newInstance();
187	187	} catch (final Exception e) {
	188	} catch (final Error e) {
188	189	}
189	190	}
190	191	if (base64 == null) {

+1

-1

xstream-benchmark/pom.xml less more

13	13	<parent>
14	14	<groupId>com.thoughtworks.xstream</groupId>
15	15	<artifactId>xstream-parent</artifactId>
16		<version>1.4.11</version>
	16	<version>1.4.11.1</version>
17	17	</parent>
18	18	<artifactId>xstream-benchmark</artifactId>
19	19	<packaging>jar</packaging>

+1

-1

xstream-distribution/pom.xml less more

13	13	<parent>
14	14	<groupId>com.thoughtworks.xstream</groupId>
15	15	<artifactId>xstream-parent</artifactId>
16		<version>1.4.11</version>
	16	<version>1.4.11.1</version>
17	17	</parent>
18	18	<artifactId>xstream-distribution</artifactId>
19	19	<packaging>pom</packaging>

+10

-1

xstream-distribution/src/content/changes.html less more

32	32
33	33	<p>Not yet released.</p>
34	34	-->
	35	<h1 id="1.4.11.1">1.4.11.1</h1>
	36
	37	<p>Released October 27, 2018.</p>
	38
	39	<h2>Hot fix</h2>
	40
	41	<ul>
	42	<li>GHI:#133: XStream 1.4.11 fails to run on a Java Runtime < 8.</li>
	43	</ul>
35	44
36	45	<h1 id="1.4.11">1.4.11</h1>
37	46

45	54
46	55	<ul>
47	56	<li>GHPR:#91, GHPR:#106: Clean-up data stacks in UnmarshallingContext implementations in case of exception (by
48		Määrt Bakhoff).</li>
	57	Märt Bakhoff).</li>
49	58	<li>GHI:#2: Unneeded contention in DefaultConverterLookup.</li>
50	59	<li>GHI:#94: Fix PathConverter containing absolute Windows paths.</li>
51	60	<li>GHI:#105: XStream's ObjectInputStream returns wrong values for readUnsignedByte and readUnsignedShort.</li>

+7

-7

xstream-distribution/src/content/download.html less more

17	17
18	18	<p><a href="versioning.html">About XStream version numbers...</a></p>
19	19
20		<h1 id="stable">Stable Version: <span class="version">1.4.11</span></h1>
	20	<h1 id="stable">Stable Version: <span class="version">1.4.11.1</span></h1>
21	21
22	22	<ul>
23		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-distribution/1.4.11/xstream-distribution-1.4.11-bin.zip">Binary distribution:</a></b>
	23	<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-distribution/1.4.11.1/xstream-distribution-1.4.11.1-bin.zip">Binary distribution:</a></b>
24	24	Contains the XStream jar files, the Hibernate and Benchmark modules and all the dependencies.</li>
25		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-distribution/1.4.11/xstream-distribution-1.4.11-src.zip">Source distribution:</a></b>
	25	<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-distribution/1.4.11.1/xstream-distribution-1.4.11.1-src.zip">Source distribution:</a></b>
26	26	Contains the complete XStream project as if checked out from the Subversion version tag.</li>
27		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream/1.4.11/xstream-1.4.11.jar">XStream Core only:</a>
	27	<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream/1.4.11.1/xstream-1.4.11.1.jar">XStream Core only:</a>
28	28	The xstream.jar only as it is downloaded automatically when it is referenced as Maven dependency.</b></li>
29		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-hibernate/1.4.11/xstream-hibernate-1.4.11.jar">XStream Hibernate module:</a></b>
	29	<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-hibernate/1.4.11.1/xstream-hibernate-1.4.11.1.jar">XStream Hibernate module:</a></b>
30	30	The xstream-hibernate.jar as it is downloaded automatically when it is referenced as Maven dependency.</li>
31		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-jmh/1.4.11/xstream-jmh-1.4.11-app.zip">XStream JMH module:</a></b>
	31	<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-jmh/1.4.11.1/xstream-jmh-1.4.11.1-app.zip">XStream JMH module:</a></b>
32	32	The xstream-jmh-app.zip as standalone application with start scripts and all required libraries.</li>
33	33	<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream/1.4.11-java7/xstream-1.4.11-java7.jar">XStream Core for Java 7 only:</a>
34		The xstream.jar only without the Java 8 stuff as it is downloaded automatically when it is referenced as Maven dependency.</b></li>
	34	The xstream.jar only <a href="faq.html#Compatibility_Android">without the Java 8 stuff</a> as it is downloaded automatically when it is referenced as Maven dependency.</b></li>
35	35	</ul>
36	36
37	37	<h1 id="previous-releases">Previous Releases</h1>

+30

-5

xstream-distribution/src/content/faq.html less more

34	34	<p>XStream 1.4.x requires Java 1.4 or later. Note, that the XStream libraries contains class files targeting
35	35	different Java runtime versions or Java features. These classes are loaded by reflection and only used if XStream
36	36	is running on an appropriate runtime environment.</p>
	37	<p>Environments that load all class files of a Java archive can fail with this approach, the
	38	<a href="#Compatibility_Android">Android runtime</a> is such an example. You can build your own version of XStream
	39	with a <a href="#Compatibility_JDK">lower JDK</a> then.</p>
	40	<p>For Java 9 and later you will currently have to permit the now illegal access for XStream to operate.</p>
37	41
38	42	<!-- ...................................................... -->
39	43	<h2 id="Compatibility_JDK">Which JDK is required to build XStream?</h2>
40	44	<p>XStream 1.4.x can be build still with JDK 1.4 (see BUILD.txt). However, to support the latest features it
41		requires currently a JDK of Java 8. Otherwise the resulting jar files will miss some classes not available on
	45	requires currently a JDK of Java 8. Otherwise the resulting jar file will miss some class files not available on
42	46	earlier runtimes. Depending on the target environment this can be useful (e.g. for Android or GAE).</p>
	47	<p>Note, that such Java archives will fail on higher Java runtimes then.</p>
43	48
44	49	<!-- ...................................................... -->
45	50	<h2 id="Compatibility_Dependencies">Which dependencies are required to run XStream?</h2>

47	52	However it depends on the use case. XStream will run without dependencies using the DOM driver on all Java runtimes
48	53	or the StAX driver in combination with Java 6 or greater. See the list of <a
49	54	href="download.html#optional-deps">optional dependencies</a>.</p>
	55	<p>Note, that XStream's manifest contains OSGi entries that declare all dependencies as optional.</p>
50	56
51	57	<!-- ...................................................... -->
52	58	<h2 id="Compatibility_JVMs">Does XStream behave differently across different JVMs?</h2>

65	71	starting with R25.1.0. Generally it works for all modern Java runtimes based on OpenJDK. Android basically supports
66	72	the enhanced mode as well as the Google Application Engine, but the latter's security model limits the types that
67	73	can be handled. Note, that an active SecurityManager might prevent the usage of the enhanced mode also.</p>
	74	<p>Since Java 9 it is required to permit the now illegal access.</p>
68	75
69	76	<!-- ...................................................... -->
70	77	<h2 id="Compatibility_enhanced_mode_advantage">What are the advantages of using enhanced mode over pure Java mode?</h2>

85	92	<tr><td>Private fields</td><td>Yes</td><td>Yes</td></tr>
86	93	<tr><td>Final fields</td><td>Yes >= JDK 1.5</td><td>Yes</td></tr>
87	94	</table>
88
89		<p>Note, that these undocumented features are still available with Java 9, since there is currently no public
90		functionality provided as replacement.</p>
	95
	96	<!-- ...................................................... -->
	97	<h2 id="Compatibility_illegal_reflective_access">Java runtime warns me about an illegal reflective access by XStream!</h2>
	98
	99	<p>Yes, this is normal. A big part of XStream is reflection based and there is currently no replacement for the
	100	complete required functionality. You will have to permit this access currently, otherwise XStream will not work.</p>
	101
	102	<!-- ...................................................... -->
	103	<h2 id="Compatibility_no_module">Why does XStream not even declare an automated module name?</h2>
	104
	105	<p>Such a declaration would move XStream automatically into the module class path. However, in this environment a
	106	lot of functionality does no longer work. Therefore it is on purpose that XStream stays currently in the unnamed
	107	module.</p>
	108
	109	<!-- ...................................................... -->
	110	<h2 id="Compatibility_JPMS">Will XStream support the Java Platform Module System (JPMS)?</h2>
	111
	112	<p>At some point definitely. However, you will have to accept a limited functionality only, comparable to the pure
	113	Java mode. The access model is very restrictive and XStream will no longer be able to marshal all types of the Java
	114	runtime like now.</p>
91	115
92	116	<!-- ...................................................... -->
93	117	<h2 id="Compatibility_XPP">Why is my application not able to create a XmlPullParser with the XppDriver since XStream 1.4?</h2>

114	138	that is equivalent to the Java level supported by the target version of Android.</p>
115	139
116	140	<p>Since XStream 1.4.10 an additional artifact is deployed to the Central Maven Repository with <em>-java7</em>
117		appended to the version that explicitly does not contain any Java 8 related stuff.</p>
	141	appended to the version that explicitly does not contain any Java 8 related stuff. Note that this version will fail
	142	on higher runtimes.</p>
118	143
119	144	<!-- ...................................................... -->
120	145	<h2 id="Compatibility_GAE">Which limits exists for XStream in Google's Application Engine (GAE)?</h2>

+3

-1

xstream-distribution/src/content/index.html less more

72	72
73	73	<h1 id="news">Latest News</h1>
74	74
75		<h2 id="1.4.11"><b>October 23, 2018</b> XStream 1.4.11 released</h2>
	75	<h2 id="1.4.11.1"><b>October 27, 2018</b> XStream 1.4.11.1 released</h2>
	76
	77	<p class="highlight">Hot fix for XStream 1.4.11: Accidental breakage of Java runtimes %lt; 8.</p>
76	78
77	79	<p class="highlight">This maintenance release addresses again the security vulnerability <a href="CVE-2013-7285.html">
78	80	CVE-2013-7285</a>, an arbitrary execution of commands when unmarshalling for XStream instances with

+1

-1

xstream-hibernate/pom.xml less more

12	12	<parent>
13	13	<groupId>com.thoughtworks.xstream</groupId>
14	14	<artifactId>xstream-parent</artifactId>
15		<version>1.4.11</version>
	15	<version>1.4.11.1</version>
16	16	</parent>
17	17	<artifactId>xstream-hibernate</artifactId>
18	18	<packaging>jar</packaging>

+1

-1

xstream-jmh/pom.xml less more

12	12	<parent>
13	13	<groupId>com.thoughtworks.xstream</groupId>
14	14	<artifactId>xstream-parent</artifactId>
15		<version>1.4.11</version>
	15	<version>1.4.11.1</version>
16	16	</parent>
17	17	<artifactId>xstream-jmh</artifactId>
18	18	<packaging>jar</packaging>