项目将com.thoughtworks.xstream升级到1.4.18遇到的问题：com.thoughtworks.xstream.security.ForbiddenClassException

项目开发需求将xstream从1.4.17升级到1.4.18，升级后遇到了序列化问题，描述如下：

om.thoughtworks.xstream.security.ForbiddenClassException: com.jd.jcloud.wms.pickingplan.dto.eclp.SoOrderCancelReceipt
at com.thoughtworks.xstream.security.NoTypePermission.allows(NoTypePermission.java:26) ~[xstream-1.4.18.jar:1.4.18]
at com.thoughtworks.xstream.mapper.SecurityMapper.realClass(SecurityMapper.java:74) ~[xstream-1.4.18.jar:1.4.18]
at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125) ~[xstream-1.4.18.jar:1.4.18]
at com.thoughtworks.xstream.mapper.CachingMapper.realClass(CachingMapper.java:47) ~[xstream-1.4.18.jar:1.4.18]
at com.thoughtworks.xstream.core.util.HierarchicalStreams.readClassType(HierarchicalStreams.java:29) ~[xstream-1.4.18.jar:1.4.18]
at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:133) ~[xstream-1.4.18.jar:1.4.18]
at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32) ~[xstream-1.4.18.jar:1.4.18]

问题还原：
pom.xml

<dependency><groupId>com.thoughtworks.xstream</groupId><artifactId>xstream</artifactId><version>1.4.18</version>
</dependency>

代码

public static void main(String[] args) {XStream xStream = new XStream();String xmlStr = "<receipt>\n" +"<receiptNo>1234567</receiptNo>\n" +"<distributeNo></distributeNo>\n" +"<warehouseNo>123</warehouseNo>\n" +"<erpWarehouseNo></erpWarehouseNo>\n" +"<receiptType>123</receiptType>\n" +"<source>123</source>\n" +"<partnerNo>123</partnerNo>\n" +"<clpsWarehouseNo>123</clpsWarehouseNo>\n" +"</receipt>";xStream.alias("receipt", SoOrderCancelReceipt.class);xStream.ignoreUnknownElements();SoOrderCancelReceipt soOrderReceipt = (SoOrderCancelReceipt) xStream.fromXML(xmlStr);System.out.println(JSON.toJSONString(soOrderReceipt));}

结果：

Exception in thread "main" com.thoughtworks.xstream.security.ForbiddenClassException: SoOrderCancelReceiptat com.thoughtworks.xstream.security.NoTypePermission.allows(NoTypePermission.java:26)at com.thoughtworks.xstream.mapper.SecurityMapper.realClass(SecurityMapper.java:74)at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)at com.thoughtworks.xstream.mapper.CachingMapper.realClass(CachingMapper.java:47)at com.thoughtworks.xstream.core.util.HierarchicalStreams.readClassType(HierarchicalStreams.java:29)at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:133)at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1391)at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1376)at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1261)at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1252)at Test3.main(Test3.java:35)

处理方案：解析之前，在前面添加以下两行代码

Class<?>[] classes = new Class[] { SoOrderCancelReceipt.class};
xStream.allowTypes(classes);

完整代码如下：

    public static void main(String[] args) {XStream xStream = new XStream();String xmlStr = "<receipt>\n" +"<receiptNo>123456</receiptNo>\n" +"<distributeNo></distributeNo>\n" +"<warehouseNo>123</warehouseNo>\n" +"<erpWarehouseNo></erpWarehouseNo>\n" +"<receiptType>123</receiptType>\n" +"<source>123</source>\n" +"<partnerNo>123</partnerNo>\n" +"<clpsWarehouseNo>123</clpsWarehouseNo>\n" +"</receipt>";xStream.alias("receipt", SoOrderCancelReceipt.class);xStream.ignoreUnknownElements();Class<?>[] classes = new Class[] { SoOrderCancelReceipt.class};xStream.allowTypes(classes);SoOrderCancelReceipt soOrderReceipt = (SoOrderCancelReceipt) xStream.fromXML(xmlStr);System.out.println(JSON.toJSONString(soOrderReceipt));}

执行结果：

{"clpsWarehouseNo":"123","distributeNo":"","partnerNo":"123","receiptNo":"123456","receiptType":"123","source":123,"warehouseNo":"123"}Process finished with exit code 0

项目将com.thoughtworks.xstream升级到1.4.18遇到的问题：com.thoughtworks.xstream.security.ForbiddenClassException相关推荐

xstream异常com.thoughtworks.xstream.security.ForbiddenClassException
最近项目使用到webservice调用厂商的接口,遇到的需要解析错误信息的需求,于是对于错误信息的解析使用比较暴力方式:使用XStream直接手动解析错误消息到对象. 在解析的过程中遇到了com.th ...
linux mint 18内核版本,Linux Mint 18.2用户如何升级到Linux Mint 18.3“Sylvia”
Linux Mint 18.2"Sonya"操作系统的升级路径目前已正式开放,用户可将其升级到最新的Linux Mint 18.3"Sylvia"版本. Lin ...
linux内核多大 4.17.8,Linux Kernel 4.17结束支持，请升级到Linux 4.18内核
Linux Kernel 4.17最后一个更新是Linux Kernel 4.17.19内核,该系列内核版本将结束支持,它不会再得到新的更新,请用户把Linux内核升级到4.18版本,这样能避免安全漏 ...
Linux Glibc幽灵漏洞紧急修补方案；Centos7升级内核到3.18
本文转载:http://ixdba.blog.51cto.com/2895551/1609526 幽灵漏洞是Linux glibc库上出现的一个严重的安全问题,他可以让***者在不了解系统的任何情况下 ...
linux mint 17 升级,如何从Linux Mint 17.3升级到Linux Mint 18
上个月,Linux Mint的开发团队发布了Linux Mint的18稳定版.这家现代化的,高度抛光和舒适,基于Ubuntu的Linux发行版,其中渴望尝试一些新的功能和改进的许多用户,它来了一个长着 ...
如何将asp.net MVC2项目升级为MVC3项目（微软官方自动升级工具：ASP.NET MVC 3 Application Upgrader ）...
微软最近发布了一个自动工具来完成这个复杂的升级工作,但这个工具本身很难找到,被baidu/google中众多讨论手工升级的文章压在底下.偶然找到特此与大家分享: ASP.NET MVC 3 Appli ...
项目实战4——uniapp在线升级关联云空间
升级中心 uni-upgrade-center - App: https://ext.dcloud.net.cn/plugin?id=4542 App升级中心 uni-upgrade-center文档 ...
STM32项目中一种在线升级/应用升级OTA-IAP设计方案
STM32 OTA-IAP设计方案 OTA是Over-the-Air的简写,即空中下载技术,通过网络远程给用户进行系统更新和升级.IAP是In Application Programming的简写,I ...
微信小程序-基于云开发实现社区项目（Demo版本的升级）
针对上一版 [微信小程序~云开发的实现的一个社区 Demo(完结~)] 项目的问题,做了问题修复和功能优化以及UI美化,起码整体界面效果看起来不那么"程序员"了.同时还新增了很多小 ...

项目将com.thoughtworks.xstream升级到1.4.18遇到的问题：com.thoughtworks.xstream.security.ForbiddenClassException

项目将com.thoughtworks.xstream升级到1.4.18遇到的问题：com.thoughtworks.xstream.security.ForbiddenClassException相关推荐

最新文章

热门文章