This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch WW-2815-xstream
in repository https://gitbox.apache.org/repos/asf/struts.git
commit bb7161029669b6d2055ac42ff17de315ef1272f0
Author: Lukasz Lenart
AuthorDate: Mon Oct 17 08:54:03 2022 +0200
WW-2815 Refactors XStreamHandler to allow to provide a custom configuration
---
.../struts2/rest/handler/XStreamHandler.java | 33 +++--
.../XStreamAllowedClassNames.java} | 4 +-
.../XStreamAllowedClasses.java}| 4 +-
.../{ => xstream}/XStreamPermissionProvider.java | 2 +-
.../XStreamProvider.java} | 12 +-
.../struts2/rest/handler/XStreamHandlerTest.java | 160 +
6 files changed, 195 insertions(+), 20 deletions(-)
diff --git
a/plugins/rest/src/main/java/org/apache/struts2/rest/handler/XStreamHandler.java
b/plugins/rest/src/main/java/org/apache/struts2/rest/handler/XStreamHandler.java
index 22e597561..d3534e32b 100644
---
a/plugins/rest/src/main/java/org/apache/struts2/rest/handler/XStreamHandler.java
+++
b/plugins/rest/src/main/java/org/apache/struts2/rest/handler/XStreamHandler.java
@@ -21,6 +21,7 @@ package org.apache.struts2.rest.handler;
import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.ModelDriven;
import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.io.xml.StaxDriver;
import com.thoughtworks.xstream.security.ArrayTypePermission;
import com.thoughtworks.xstream.security.ExplicitTypePermission;
import com.thoughtworks.xstream.security.NoTypePermission;
@@ -29,12 +30,15 @@ import
com.thoughtworks.xstream.security.PrimitiveTypePermission;
import com.thoughtworks.xstream.security.TypePermission;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
+import org.apache.struts2.rest.handler.xstream.XStreamAllowedClassNames;
+import org.apache.struts2.rest.handler.xstream.XStreamAllowedClasses;
+import org.apache.struts2.rest.handler.xstream.XStreamPermissionProvider;
+import org.apache.struts2.rest.handler.xstream.XStreamProvider;
import java.io.IOException;
import java.io.Reader;
import java.io.Writer;
import java.util.Collection;
-import java.util.Date;
import java.util.Map;
import java.util.Set;
@@ -68,7 +72,15 @@ public class XStreamHandler extends
AbstractContentTypeHandler {
}
protected XStream createXStream(ActionInvocation invocation) {
-XStream stream = new XStream();
+XStream stream;
+if (invocation.getAction() instanceof XStreamProvider) {
+LOG.debug("Using provider {} to create instance of XStream",
invocation.getAction().getClass().getSimpleName());
+stream = ((XStreamProvider)
invocation.getAction()).createXStream();
+} else {
+LOG.debug("Creating default XStream instance using Stax driver:
{}", StaxDriver.class.getSimpleName());
+stream = new XStream(new StaxDriver());
+}
+
LOG.debug("Clears existing permissions");
stream.addPermission(NoTypePermission.NONE);
@@ -82,13 +94,13 @@ public class XStreamHandler extends
AbstractContentTypeHandler {
private void addPerActionPermission(ActionInvocation invocation, XStream
stream) {
Object action = invocation.getAction();
-if (action instanceof AllowedClasses) {
-Set> allowedClasses = ((AllowedClasses)
action).allowedClasses();
-stream.addPermission(new
ExplicitTypePermission(allowedClasses.toArray(new
Class[allowedClasses.size()])));
+if (action instanceof XStreamAllowedClasses) {
+Set> allowedClasses = ((XStreamAllowedClasses)
action).allowedClasses();
+stream.addPermission(new
ExplicitTypePermission(allowedClasses.toArray(new Class[0])));
}
-if (action instanceof AllowedClassNames) {
-Set allowedClassNames = ((AllowedClassNames)
action).allowedClassNames();
-stream.addPermission(new
ExplicitTypePermission(allowedClassNames.toArray(new
String[allowedClassNames.size()])));
+if (action instanceof XStreamAllowedClassNames) {
+Set allowedClassNames = ((XStreamAllowedClassNames)
action).allowedClassNames();
+stream.addPermission(new
ExplicitTypePermission(allowedClassNames.toArray(new String[0])));
}
if (action instanceof XStreamPermissionProvider) {
Collection permissions =
((XStreamPermissionProvider) action).getTypePermissions();
@@ -101,13 +113,12 @@ public class XStreamHandler extends
AbstractContentTypeHandler {
protected void addDefaultPermissions(ActionInvocation invocation, XStream
stream) {
stream.addPermission(new ExplicitTypePermission(new
Class[]{invocation.getAction().getClass()}));
if (invocation.getAction() instanceof ModelDriven) {
-stream.addPermission(new ExplicitTypePermission(n
