Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clear XStream default whitelist #477

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Clear XStream default whitelist #477

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
cc69274
Uopdated Message loading. See #425.
rygel Oct 26, 2018
70b4ce3
Merge branch 'master' of https://github.com/pippo-java/pippo into add…
rygel Oct 29, 2018
77bb5dd
Add suggestion to whitelist whole package names.
rygel Oct 29, 2018
631668e
- Adding RegExp to WhitelistObjectInputStream.java
rygel Oct 29, 2018
c2f030d
New removed wrong commit.
rygel Oct 29, 2018
a233889
Merge branch 'master' of https://github.com/pippo-java/pippo into fix…
rygel Nov 1, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions pippo-content-type-parent/pippo-xstream/src/main/java/ro/pippo/xstream/XstreamEngine.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,17 @@
*/
package ro.pippo.xstream;

import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.security.NoTypePermission;
import org.kohsuke.MetaInfServices;
import ro.pippo.core.Application;
import ro.pippo.core.ContentTypeEngine;
import ro.pippo.core.HttpConstants;

import com.thoughtworks.xstream.XStream;
import ro.pippo.core.util.WhitelistObjectInputStream;

import java.util.regex.Pattern;

/**
* An XmlEngine based on XStream.
*
Expand All @@ -41,17 +45,17 @@ public String getContentType() {

private XStream xstream() {
XStream xstream = new XStream();

// allow annotations on models for maximum flexibility
xstream.autodetectAnnotations(true);

// prevent xstream from creating complex XML graphs
xstream.setMode(XStream.NO_REFERENCES);

// setup security (see http://x-stream.github.io/security.html)
xstream.allowTypes(WhitelistObjectInputStream.getWhiteClassNames());
xstream.allowTypesByRegExp(WhitelistObjectInputStream.getWhiteRegEx());
// clear out existing permissions and set own ones
xstream.addPermission(NoTypePermission.NONE);
Copy link
Member

@decebals decebals Nov 2, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, in the end this is the single modification.


//setup security
xstream.allowTypes((String[]) WhitelistObjectInputStream.getWhitelistedClassNames().toArray());
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand why these cast (see diff).

xstream.allowTypesByRegExp((Pattern[]) WhitelistObjectInputStream.getWhitelistedRegExp().toArray());
return xstream;
}

Expand All @@ -60,7 +64,6 @@ public String toString(Object object) {
return xstream().toXML(object);
}

@SuppressWarnings("unchecked")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Without this annotation I retrieve a warning. The annotation was added by me in the previous commit.

@Override
public <T> T fromString(String content, Class<T> classOfT) {
return (T) xstream().fromXML(content);
Expand Down