Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Additional docs about security vulnerabilities with XStream.

Browse Source
This commit is contained in:
Arjen Poutsma
2013-07-24 15:54:32 +02:00
committed by Rossen Stoyanchev
parent b6c54c3637
commit 4da7e304b8
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/reference/docbook/oxm.xml
View File

@@ -755,7 +755,11 @@ public class Application {
<para>
By default, XStream allows for arbitrary classes to be unmarshalled, which can result in security
vulnerabilities.
As such, it is recommended to set the <property>supportedClasses</property> property on the
As such, it is <emphasis>not recommended to use the <classname>XStreamMarshaller</classname> to
unmarshal XML from external sources</emphasis> (i.e. the Web), as this can result in
<emphasis>security vulnerabilities</emphasis>.
If you do use the <classname>XStreamMarshaller</classname> to unmarshal XML from an external source,
set the <property>supportedClasses</property> property on the
<classname>XStreamMarshaller</classname>, like so:
<programlisting language="xml"><![CDATA[<bean id="xstreamMarshaller" class="org.springframework.oxm.xstream.XStreamMarshaller">
<property name="supportedClasses" value="org.springframework.oxm.xstream.Flight"/>