Convenient configuration of type permissions for XStream 1.4.18

Closes gh-27343

spring-oxm/src/test/java/org/springframework/oxm/xstream/XStreamMarshallerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -43,6 +43,7 @@ import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
 import com.thoughtworks.xstream.io.json.JettisonMappedXmlDriver;
 import com.thoughtworks.xstream.io.json.JsonHierarchicalStreamDriver;
 import com.thoughtworks.xstream.io.json.JsonWriter;
+import com.thoughtworks.xstream.security.AnyTypePermission;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.InOrder;
@@ -67,18 +68,21 @@ import static org.mockito.Mockito.mock;
 /**
  * @author Arjen Poutsma
  * @author Sam Brannen
+ * @author Juergen Hoeller
  */
 class XStreamMarshallerTests {
 
 	private static final String EXPECTED_STRING = "<flight><flightNumber>42</flightNumber></flight>";
 
-	private final XStreamMarshaller marshaller = new XStreamMarshaller();
-
 	private final Flight flight = new Flight();
 
+	private XStreamMarshaller marshaller;
+
 
 	@BeforeEach
 	void createMarshaller() {
+		marshaller = new XStreamMarshaller();
+		marshaller.setTypePermissions(AnyTypePermission.ANY);
 		marshaller.setAliases(Collections.singletonMap("flight", Flight.class.getName()));
 		flight.setFlightNumber(42L);
 	}
@@ -143,7 +147,7 @@ class XStreamMarshallerTests {
 		ByteArrayOutputStream os = new ByteArrayOutputStream();
 		StreamResult result = new StreamResult(os);
 		marshaller.marshal(flight, result);
-		String s = new String(os.toByteArray(), "UTF-8");
+		String s = os.toString("UTF-8");
 		assertThat(XmlContent.of(s)).isSimilarTo(EXPECTED_STRING);
 	}
 

spring-oxm/src/test/java/org/springframework/oxm/xstream/XStreamUnmarshallerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package org.springframework.oxm.xstream;
 
 import java.io.ByteArrayInputStream;
 import java.io.StringReader;
+import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -29,6 +30,7 @@ import javax.xml.transform.Source;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamSource;
 
+import com.thoughtworks.xstream.security.AnyTypePermission;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.w3c.dom.Document;
@@ -40,6 +42,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 
 /**
  * @author Arjen Poutsma
+ * @author Juergen Hoeller
  */
 public class XStreamUnmarshallerTests {
 
@@ -47,21 +50,16 @@ public class XStreamUnmarshallerTests {
 
 	private XStreamMarshaller unmarshaller;
 
+
 	@BeforeEach
-	public void createUnmarshaller() throws Exception {
+	public void createUnmarshaller() {
 		unmarshaller = new XStreamMarshaller();
+		unmarshaller.setTypePermissions(AnyTypePermission.ANY);
 		Map<String, Class<?>> aliases = new HashMap<>();
 		aliases.put("flight", Flight.class);
 		unmarshaller.setAliases(aliases);
 	}
 
-	private void testFlight(Object o) {
-		boolean condition = o instanceof Flight;
-		assertThat(condition).as("Unmarshalled object is not Flights").isTrue();
-		Flight flight = (Flight) o;
-		assertThat(flight).as("Flight is null").isNotNull();
-		assertThat(flight.getFlightNumber()).as("Number is invalid").isEqualTo(42L);
-	}
 
 	@Test
 	public void unmarshalDomSource() throws Exception {
@@ -83,7 +81,7 @@ public class XStreamUnmarshallerTests {
 
 	@Test
 	public void unmarshalStreamSourceInputStream() throws Exception {
-		StreamSource source = new StreamSource(new ByteArrayInputStream(INPUT_STRING.getBytes("UTF-8")));
+		StreamSource source = new StreamSource(new ByteArrayInputStream(INPUT_STRING.getBytes(StandardCharsets.UTF_8)));
 		Object flights = unmarshaller.unmarshal(source);
 		testFlight(flights);
 	}
@@ -94,5 +92,15 @@ public class XStreamUnmarshallerTests {
 		Object flights = unmarshaller.unmarshal(source);
 		testFlight(flights);
 	}
+
+
+	private void testFlight(Object o) {
+		boolean condition = o instanceof Flight;
+		assertThat(condition).as("Unmarshalled object is not Flights").isTrue();
+		Flight flight = (Flight) o;
+		assertThat(flight).as("Flight is null").isNotNull();
+		assertThat(flight.getFlightNumber()).as("Number is invalid").isEqualTo(42L);
+	}
+
 }