Repository: camel
Updated Branches:
refs/heads/master 0e1e821c1 -> 4491c080c
[CAMEL-9297] Expose more configuration options from Camel's XStream
Project: http://git-wip-us.apache.org/repos/asf/camel/repo
Commit: http://git-wip-us.apache.org/repos/asf/camel/commit/4491c080
Tree: http://git-wip-us.apache.org/repos/asf/camel/tree/4491c080
Diff: http://git-wip-us.apache.org/repos/asf/camel/diff/4491c080
Branch: refs/heads/master
Commit: 4491c080cb6c8659fc05441e49307b7d4349aa56
Parents: 0e1e821
Author: Akitoshi Yoshida <ay@apache.org>
Authored: Wed Nov 11 10:44:24 2015 +0100
Committer: Akitoshi Yoshida <ay@apache.org>
Committed: Wed Nov 11 12:04:53 2015 +0100
----------------------------------------------------------------------
.../model/dataformat/XStreamDataFormat.java | 17 +-
.../xstream/AbstractXStreamWrapper.java | 64 ++++++-
.../xstream/MarshalDomainObjectTest.java | 12 ++
.../xstream/UnmarshalThenMarshalTest.java | 13 ++
.../xstream/XStreamConcurrencyTest.java | 12 ++
.../xstream/XStreamConfigurationTest.java | 12 ++
.../XStreamDataFormatDriverConfigTest.java | 1 -
...DataFormatPermissionsSystemPropertyTest.java | 47 +++++
.../XStreamDataFormatPermissionsTest.java | 178 +++++++++++++++++++
.../dataformat/xstream/XStreamTestUtils.java | 46 +++++
.../xstream/SpringXStreamConfigurationTest.xml | 3 +-
parent/pom.xml | 2 +-
12 files changed, 401 insertions(+), 6 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/camel-core/src/main/java/org/apache/camel/model/dataformat/XStreamDataFormat.java
----------------------------------------------------------------------
diff --git a/camel-core/src/main/java/org/apache/camel/model/dataformat/XStreamDataFormat.java
b/camel-core/src/main/java/org/apache/camel/model/dataformat/XStreamDataFormat.java
index e1f86db..4d433d2 100644
--- a/camel-core/src/main/java/org/apache/camel/model/dataformat/XStreamDataFormat.java
+++ b/camel-core/src/main/java/org/apache/camel/model/dataformat/XStreamDataFormat.java
@@ -57,6 +57,8 @@ public class XStreamDataFormat extends DataFormatDefinition {
private String driverRef;
@XmlAttribute
private String mode;
+ @XmlAttribute
+ private String permissions;
@XmlJavaTypeAdapter(ConvertersAdapter.class)
@XmlElement(name = "converters")
@@ -180,6 +182,17 @@ public class XStreamDataFormat extends DataFormatDefinition {
this.implicitCollections = implicitCollections;
}
+ public String getPermissions() {
+ return permissions;
+ }
+
+ /**
+ * Adds permissionsList
+ */
+ public void setPermissions(String permissions) {
+ this.permissions = permissions;
+ }
+
@Override
protected DataFormat createDataFormat(RouteContext routeContext) {
if ("json".equals(this.driver)) {
@@ -210,6 +223,9 @@ public class XStreamDataFormat extends DataFormatDefinition {
if (this.implicitCollections != null) {
setProperty(camelContext, dataFormat, "implicitCollections", this.implicitCollections);
}
+ if (this.permissions != null) {
+ setProperty(camelContext, dataFormat, "permissions", this.permissions);
+ }
if (this.mode != null) {
setProperty(camelContext, dataFormat, "mode", mode);
}
@@ -547,5 +563,4 @@ public class XStreamDataFormat extends DataFormatDefinition {
return "OmitField[" + clsName + ", fields=" + Arrays.asList(this.fields) + "]";
}
}
-
}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/main/java/org/apache/camel/dataformat/xstream/AbstractXStreamWrapper.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/main/java/org/apache/camel/dataformat/xstream/AbstractXStreamWrapper.java
b/components/camel-xstream/src/main/java/org/apache/camel/dataformat/xstream/AbstractXStreamWrapper.java
index b98725e..41d6d7a 100644
--- a/components/camel-xstream/src/main/java/org/apache/camel/dataformat/xstream/AbstractXStreamWrapper.java
+++ b/components/camel-xstream/src/main/java/org/apache/camel/dataformat/xstream/AbstractXStreamWrapper.java
@@ -32,7 +32,10 @@ import com.thoughtworks.xstream.core.util.CompositeClassLoader;
import com.thoughtworks.xstream.io.HierarchicalStreamDriver;
import com.thoughtworks.xstream.io.HierarchicalStreamReader;
import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
-
+import com.thoughtworks.xstream.security.AnyTypePermission;
+import com.thoughtworks.xstream.security.ExplicitTypePermission;
+import com.thoughtworks.xstream.security.TypePermission;
+import com.thoughtworks.xstream.security.WildcardTypePermission;
import org.apache.camel.CamelContext;
import org.apache.camel.Exchange;
import org.apache.camel.converter.jaxp.StaxConverter;
@@ -47,7 +50,9 @@ import org.apache.camel.util.ObjectHelper;
* ({@link DataFormat}) interface which leverage the XStream library for XML or JSON's marshaling
and unmarshaling
*/
public abstract class AbstractXStreamWrapper extends ServiceSupport implements DataFormat,
DataFormatName {
-
+ private static final String PERMISSIONS_PROPERTY_KEY = "org.apache.camel.xstream.permissions";
+ private static final String PERMISSIONS_PROPERTY_DEFAULT = "-*,java.lang.*,java.util.*";
+
private XStream xstream;
private HierarchicalStreamDriver xstreamDriver;
private StaxConverter staxConverter;
@@ -55,6 +60,7 @@ public abstract class AbstractXStreamWrapper extends ServiceSupport implements
D
private Map<String, String> aliases;
private Map<String, String[]> omitFields;
private Map<String, String[]> implicitCollections;
+ private String permissions;
private String mode;
public AbstractXStreamWrapper() {
@@ -174,6 +180,14 @@ public abstract class AbstractXStreamWrapper extends ServiceSupport implements
D
}
}
+ addDefaultPermissions(xstream);
+ if (this.permissions != null) {
+ // permissions ::= pterm (',' pterm)* # consits of one or more terms
+ // pterm ::= aod? wterm # each term preceded by an optional
sign
+ // aod ::= '+' | '-' # indicates allow or deny where allow
if omitted
+ // wterm ::= a class name with optional wildcard characters
+ addPermissions(xstream, permissions);
+ }
} catch (Exception e) {
throw new RuntimeException("Unable to build XStream instance", e);
}
@@ -181,6 +195,44 @@ public abstract class AbstractXStreamWrapper extends ServiceSupport implements
D
return xstream;
}
+ private static void addPermissions(XStream xstream, String permissions) {
+ for (String pterm : permissions.split(",")) {
+ boolean aod;
+ pterm = pterm.trim();
+ if (pterm.startsWith("-")) {
+ aod = false;
+ pterm = pterm.substring(1);
+ } else {
+ aod = true;
+ if (pterm.startsWith("+")) {
+ pterm = pterm.substring(1);
+ }
+ }
+ TypePermission typePermission = null;
+ if ("*".equals(pterm)) {
+ // accept or deny any
+ typePermission = AnyTypePermission.ANY;
+ } else if (pterm.indexOf('*') < 0) {
+ // exact type
+ typePermission = new ExplicitTypePermission(new String[]{pterm});
+ } else if (pterm.length() > 0) {
+ // wildcard type
+ typePermission = new WildcardTypePermission(new String[]{pterm});
+ }
+ if (typePermission != null) {
+ if (aod) {
+ xstream.addPermission(typePermission);
+ } else {
+ xstream.denyPermission(typePermission);
+ }
+ }
+ }
+ }
+
+ private static void addDefaultPermissions(XStream xstream) {
+ addPermissions(xstream, System.getProperty(PERMISSIONS_PROPERTY_KEY, PERMISSIONS_PROPERTY_DEFAULT));
+ }
+
protected int getModeFromString(String modeString) {
int result;
if ("NO_REFERENCES".equalsIgnoreCase(modeString)) {
@@ -252,6 +304,14 @@ public abstract class AbstractXStreamWrapper extends ServiceSupport implements
D
this.xstreamDriver = xstreamDriver;
}
+ public String getPermissions() {
+ return permissions;
+ }
+
+ public void setPermissions(String permissions) {
+ this.permissions = permissions;
+ }
+
public String getMode() {
return mode;
}
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalDomainObjectTest.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalDomainObjectTest.java
b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalDomainObjectTest.java
index 2992a12..63bc534 100644
--- a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalDomainObjectTest.java
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalDomainObjectTest.java
@@ -19,6 +19,8 @@ package org.apache.camel.dataformat.xstream;
import org.apache.camel.builder.RouteBuilder;
import org.apache.camel.component.mock.MockEndpoint;
import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
import org.junit.Test;
/**
@@ -26,6 +28,16 @@ import org.junit.Test;
*/
public class MarshalDomainObjectTest extends CamelTestSupport {
+ @BeforeClass
+ public static void setup() {
+ XStreamTestUtils.setPermissionSystemProperty("");
+ }
+
+ @AfterClass
+ public static void cleanup() {
+ XStreamTestUtils.revertPermissionSystemProperty();
+ }
+
@Test
public void testMarshalDomainObject() throws Exception {
MockEndpoint mock = getMockEndpoint("mock:result");
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/UnmarshalThenMarshalTest.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/UnmarshalThenMarshalTest.java
b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/UnmarshalThenMarshalTest.java
index 6e0f550..6e936a5 100644
--- a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/UnmarshalThenMarshalTest.java
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/UnmarshalThenMarshalTest.java
@@ -23,12 +23,25 @@ import org.apache.camel.Processor;
import org.apache.camel.builder.RouteBuilder;
import org.apache.camel.component.mock.MockEndpoint;
import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
import org.junit.Test;
/**
* @version
*/
public class UnmarshalThenMarshalTest extends CamelTestSupport {
+
+ @BeforeClass
+ public static void setup() {
+ XStreamTestUtils.setPermissionSystemProperty("");
+ }
+
+ @AfterClass
+ public static void cleanup() {
+ XStreamTestUtils.revertPermissionSystemProperty();
+ }
+
@Test
public void testSendXmlAndUnmarshal() throws Exception {
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConcurrencyTest.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConcurrencyTest.java
b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConcurrencyTest.java
index 7a34f40..b0e6aa2 100644
--- a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConcurrencyTest.java
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConcurrencyTest.java
@@ -22,6 +22,8 @@ import java.util.concurrent.Executors;
import org.apache.camel.builder.RouteBuilder;
import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
import org.junit.Test;
/**
@@ -29,6 +31,16 @@ import org.junit.Test;
*/
public class XStreamConcurrencyTest extends CamelTestSupport {
+ @BeforeClass
+ public static void setup() {
+ XStreamTestUtils.setPermissionSystemProperty("");
+ }
+
+ @AfterClass
+ public static void cleanup() {
+ XStreamTestUtils.revertPermissionSystemProperty();
+ }
+
@Test
public void testNoConcurrentProducers() throws Exception {
doSendMessages(1, 1);
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConfigurationTest.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConfigurationTest.java
b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConfigurationTest.java
index 5a9c641..b411abe 100644
--- a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConfigurationTest.java
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConfigurationTest.java
@@ -33,6 +33,8 @@ import org.apache.camel.builder.RouteBuilder;
import org.apache.camel.component.mock.MockEndpoint;
import org.apache.camel.model.dataformat.XStreamDataFormat;
import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
import org.junit.Test;
/**
@@ -42,6 +44,16 @@ public class XStreamConfigurationTest extends CamelTestSupport {
private static volatile boolean constructorInjected;
private static volatile boolean methodInjected;
+
+ @BeforeClass
+ public static void setup() {
+ XStreamTestUtils.setPermissionSystemProperty("");
+ }
+
+ @AfterClass
+ public static void cleanup() {
+ XStreamTestUtils.revertPermissionSystemProperty();
+ }
@Override
public void setUp() throws Exception {
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatDriverConfigTest.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatDriverConfigTest.java
b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatDriverConfigTest.java
index c3e44fe..207c26d 100644
--- a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatDriverConfigTest.java
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatDriverConfigTest.java
@@ -18,7 +18,6 @@ package org.apache.camel.dataformat.xstream;
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.io.json.JsonHierarchicalStreamDriver;
-import org.apache.camel.impl.DefaultClassResolver;
import org.apache.camel.test.junit4.CamelTestSupport;
import org.junit.Test;
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsSystemPropertyTest.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsSystemPropertyTest.java
b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsSystemPropertyTest.java
new file mode 100644
index 0000000..8da946d
--- /dev/null
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsSystemPropertyTest.java
@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.dataformat.xstream;
+
+import com.thoughtworks.xstream.XStream;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+public class XStreamDataFormatPermissionsSystemPropertyTest extends XStreamDataFormatPermissionsTest
{
+
+ @BeforeClass
+ public static void setup() {
+ // clear the default permissions system property
+ // see AbstractXStreamWrapper.PERMISSIONS_PROPERTY_DEFAULT
+ XStreamTestUtils.setPermissionSystemProperty("");
+ }
+
+ @AfterClass
+ public static void cleanup() {
+ XStreamTestUtils.revertPermissionSystemProperty();
+ }
+
+ @Test
+ @Override
+ public void testNone() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ Object po = xStream.fromXML(XML_PURCHASE_ORDER);
+ assertNotNull(po);
+ }
+}
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsTest.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsTest.java
b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsTest.java
new file mode 100644
index 0000000..3213624
--- /dev/null
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsTest.java
@@ -0,0 +1,178 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.dataformat.xstream;
+
+import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.security.ForbiddenClassException;
+import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.Test;
+
+public class XStreamDataFormatPermissionsTest extends CamelTestSupport {
+ protected static final String XML_PURCHASE_ORDER =
+ "<org.apache.camel.dataformat.xstream.PurchaseOrder>"
+ + "<name>foo</name>"
+ + "<price>10.0</price>"
+ + "<amount>1.0</amount>"
+ + "</org.apache.camel.dataformat.xstream.PurchaseOrder>";
+ protected static final String XML_PURCHASE_ORDERS_LIST =
+ "<list>"
+ + "<org.apache.camel.dataformat.xstream.PurchaseOrder>"
+ + "<name>foo</name>"
+ + "<price>10.0</price>"
+ + "<amount>1.0</amount>"
+ + "</org.apache.camel.dataformat.xstream.PurchaseOrder>"
+ + "<org.apache.camel.dataformat.xstream.PurchaseOrder>"
+ + "<name>bar</name>"
+ + "<price>9.0</price>"
+ + "<amount>2.0</amount>"
+ + "</org.apache.camel.dataformat.xstream.PurchaseOrder>"
+ + "</list>";
+
+ @Test
+ public void testNone() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ try {
+ xStream.fromXML(XML_PURCHASE_ORDER);
+ fail("should fail to unmarshall");
+ } catch (ForbiddenClassException e) {
+ // OK
+ }
+ }
+
+
+ @Test
+ public void testDeny() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ xStreamDataFormat.setPermissions("-org.apache.camel.dataformat.xstream.PurchaseOrder");
+
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ try {
+ xStream.fromXML(XML_PURCHASE_ORDER);
+ fail("should fail to unmarshall");
+ } catch (ForbiddenClassException e) {
+ // OK
+ }
+ }
+
+ @Test
+ public void testAllow() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ xStreamDataFormat.setPermissions("org.apache.camel.dataformat.xstream.PurchaseOrder");
+
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ Object po = xStream.fromXML(XML_PURCHASE_ORDER);
+ assertNotNull(po);
+
+ po = xStream.fromXML(XML_PURCHASE_ORDERS_LIST);
+ assertNotNull(po);
+ }
+
+ @Test
+ public void testAllowAndDeny() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ xStreamDataFormat.setPermissions("org.apache.camel.dataformat.xstream.PurchaseOrder,-org.apache.camel.dataformat.xstream.*");
+
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ try {
+ xStream.fromXML(XML_PURCHASE_ORDER);
+ fail("should fail to unmarshall");
+ } catch (ForbiddenClassException e) {
+ // OK
+ }
+ }
+
+ @Test
+ public void testDenyAndAllowDeny() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ xStreamDataFormat.setPermissions("-org.apache.camel.dataformat.xstream.*,org.apache.camel.dataformat.xstream.PurchaseOrder");
+
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ Object po = xStream.fromXML(XML_PURCHASE_ORDER);
+ assertNotNull(po);
+
+ po = xStream.fromXML(XML_PURCHASE_ORDERS_LIST);
+ assertNotNull(po);
+ }
+
+ @Test
+ public void testAllowAny() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ xStreamDataFormat.setPermissions("*");
+
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ Object po = xStream.fromXML(XML_PURCHASE_ORDER);
+ assertNotNull(po);
+
+ po = xStream.fromXML(XML_PURCHASE_ORDERS_LIST);
+ assertNotNull(po);
+ }
+
+ @Test
+ public void testAllowAnyAndDeny() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ xStreamDataFormat.setPermissions("*,-org.apache.camel.dataformat.xstream.PurchaseOrder");
+
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ try {
+ xStream.fromXML(XML_PURCHASE_ORDER);
+ fail("should fail to unmarshall");
+ } catch (ForbiddenClassException e) {
+ // OK
+ }
+ }
+
+ @Test
+ public void testDenyAny() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ xStreamDataFormat.setPermissions("-*");
+
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ try {
+ xStream.fromXML(XML_PURCHASE_ORDER);
+ fail("should fail to unmarshall");
+ } catch (ForbiddenClassException e) {
+ // OK
+ }
+ }
+
+ @Test
+ public void testDenyAnyAndAllow() {
+ XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+ xStreamDataFormat.setPermissions("-*,org.apache.camel.dataformat.xstream.PurchaseOrder");
+
+ XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+ Object po = xStream.fromXML(XML_PURCHASE_ORDER);
+ assertNotNull(po);
+
+ try {
+ xStream.fromXML(XML_PURCHASE_ORDERS_LIST);
+ fail("should fail to unmarshall");
+ } catch (ForbiddenClassException e) {
+ // OK
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamTestUtils.java
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamTestUtils.java
b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamTestUtils.java
new file mode 100644
index 0000000..ff6cf35
--- /dev/null
+++ b/components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamTestUtils.java
@@ -0,0 +1,46 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.camel.dataformat.xstream;
+
+/**
+ *
+ */
+final class XStreamTestUtils {
+ static final String PERMISSIONS_PROPERTY_KEY = "org.apache.camel.xstream.permissions";
+ private static String oldProperty;
+
+ private XStreamTestUtils() {
+ }
+
+ public static void setPermissionSystemProperty(String value) {
+ oldProperty = System.getProperty(PERMISSIONS_PROPERTY_KEY);
+ if (value == null) {
+ System.clearProperty(PERMISSIONS_PROPERTY_KEY);
+ } else {
+ System.setProperty(PERMISSIONS_PROPERTY_KEY, value);
+ }
+ }
+
+ public static void revertPermissionSystemProperty() {
+ if (oldProperty == null) {
+ System.clearProperty(PERMISSIONS_PROPERTY_KEY);
+ } else {
+ System.setProperty(PERMISSIONS_PROPERTY_KEY, oldProperty);
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/components/camel-xstream/src/test/resources/org/apache/camel/dataformat/xstream/SpringXStreamConfigurationTest.xml
----------------------------------------------------------------------
diff --git a/components/camel-xstream/src/test/resources/org/apache/camel/dataformat/xstream/SpringXStreamConfigurationTest.xml
b/components/camel-xstream/src/test/resources/org/apache/camel/dataformat/xstream/SpringXStreamConfigurationTest.xml
index a171086..97a5e80 100644
--- a/components/camel-xstream/src/test/resources/org/apache/camel/dataformat/xstream/SpringXStreamConfigurationTest.xml
+++ b/components/camel-xstream/src/test/resources/org/apache/camel/dataformat/xstream/SpringXStreamConfigurationTest.xml
@@ -29,7 +29,8 @@
<!-- we define the json xstream data formats to be used (xstream is default) -->
<dataFormats>
- <xstream id="xstream-1" mode="NO_REFERENCES">
+ <xstream id="xstream-1" mode="NO_REFERENCES"
+ permissions="-org.apache.camel.dataformat.xstream.*,org.apache.camel.dataformat.xstream.PurchaseHistory,org.apache.camel.dataformat.xstream.PurchaseOrder">
<converters>
<converter class="org.apache.camel.dataformat.xstream.XStreamConfigurationTest$PurchaseOrderConverter"
/>
</converters>
http://git-wip-us.apache.org/repos/asf/camel/blob/4491c080/parent/pom.xml
----------------------------------------------------------------------
diff --git a/parent/pom.xml b/parent/pom.xml
index 9020b15..a3e1933 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -576,7 +576,7 @@
org.apache.velocity.*;version="[1.6.2,2)",
org.apache.xmlbeans.*;version="[2.4,3)",
org.eclipse.jetty.*;version="[8.0,10)",
- com.thoughtworks.xstream.*;version="[1.3,2)",
+ com.thoughtworks.xstream.*;version="[1.4.7,2)",
org.antlr.stringtemplate.*;version="[3.0,4)",
org.ccil.cowan.tagsoup.*;version="[1.2,2)",
org.mortbay.cometd.*;version="[6.1,7)",
|