|
Restlet Framework 2.2.2 Google App Engine |
|||||||||
PREV PACKAGE NEXT PACKAGE | FRAMES NO FRAMES |
See:
Description
Class Summary | |
---|---|
XstreamConverter | Converter between the XML/JSON and Representation classes based on XStream. SECURITY WARNING: XStream applies various techniques under the hood to ensure it is able to handle all types of objects. |
XstreamRepresentation<T> | Representation based on the XStream library. |
Integration with XStream 1.4. XStream is a simple library to serialize objects to XML and back again.
It also supports JSON via a dependency on Jettison, a Stax driver for JSON.
SECURITY WARNING: XStream applies various techniques under the hood to ensure it is able to handle all types of objects.
This includes using undocumented Java features and reflection. The XML generated by XStream includes all information
required to build objects of almost any type. This introduces a potential security problem.
The XML provided to XStream for conversion to a Java object can be manipulated to inject objects into the unmarshalled
object graph, which were not present at marshalling time. An attacker could exploit this to execute arbitrary code or
shell commands in the context of the server running the XStream process. This issue has been addressed and is clearly
documented here: XStream Security Framework.
You can customize the Xstream object used by any instance of XStreamRepresentation class, by overriding the createXStream
or call the getXStream method sand apply security permissions.
|
Restlet Framework 2.2.2 Google App Engine |
|||||||||
PREV PACKAGE NEXT PACKAGE | FRAMES NO FRAMES |