Java XStream 的安全框架未初始化，XStream 可能存在漏洞
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/44698296/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Security framework of XStream not initialized, XStream is probably vulnerable
提问by GGrec
Security framework of XStream not initialized, XStream is probably vulnerable
Security framework of XStream not initialized, XStream is probably vulnerable
I keep getting this console error in red while using XStream (1.4.10)
使用 XStream (1.4.10) 时，我不断收到此控制台错误为红色
I tried the following:
我尝试了以下方法：
XStream.setupDefaultSecurity(xs);
XStream.setupDefaultSecurity(xs);
and
和
xs.addPermission(AnyTypePermission.ANY);xs.addPermission(NoTypePermission.NONE);
xs.addPermission(AnyTypePermission.ANY);xs.addPermission(NoTypePermission.NONE);
none of which got rid of it.
没有一个能摆脱它。
I do not need any fancy security settings, I just want to silence that warning. Maybe also prepare the code for 1.5.x
我不需要任何花哨的安全设置，我只想消除该警告。也许还准备了 1.5.x 的代码
采纳答案by coolersport
When dealing with security issues, I wouldn't take it lightly. Firstly one would understand the severity of the issue, here a good write upor another one.
在处理安全问题时，我不会掉以轻心。首先，人们会了解问题的严重性，这里有一篇很好的文章或其他文章。
Then find out how people recommend the solution. The good place to start is from xstream website itself. There is an example which you can use as a starting point on xstream security page.
然后找出人们如何推荐解决方案。最好的起点是从 xstream 网站本身。有一个示例，您可以将其用作xstream security page上的起点。
This would be my set up which basically allows most of your code.
这将是我的设置，它基本上允许您的大部分代码。
XStream xstream = new XStream();
// clear out existing permissions and set own ones
xstream.addPermission(NoTypePermission.NONE);
// allow some basics
xstream.addPermission(NullPermission.NULL);
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
xstream.allowTypeHierarchy(Collection.class);
// allow any type from the same package
xstream.allowTypesByWildcard(new String[] {
"com.your.package.**"
});
However, after diving more into their source code, this is my take:
然而，在深入研究他们的源代码之后，这是我的看法：
XStream.setupDefaultSecurity(this); // to be removed after 1.5
xstream.allowTypesByWildcard(new String[] {
"com.your.package.**"
});
So essentially, you will need just one line once upgrading to 1.5.
所以基本上，一旦升级到 1.5，您只需要一行。
Please note that you may need more wild cards to suit your application deserialization scenarios. This is not a one-size-fit-all answer but rather a good starting point IMHO.
请注意，您可能需要更多通配符来适应您的应用程序反序列化场景。恕我直言，这不是一个一刀切的答案，而是一个很好的起点。
回答by JEEUser0815
I had the same "problem" and solved it by allowing the relevant types:
我遇到了同样的“问题”，并通过允许相关类型解决了它：
Class<?>[] classes = new Class[] { ABC.class, XYZ.class };
XStream xStream = new XStream();
XStream.setupDefaultSecurity(xStream);
xStream.allowTypes(classes);
Maybe this also helps in your case.
也许这对您的情况也有帮助。
Good luck!
祝你好运！
回答by Lolo
It also works by specifying an all-inclusive pattern for allowed classes:
它还通过为允许的类指定全包模式来工作：
xstream.allowTypesByRegExp(new String[] { ".*" });
