Restlet Framework 2.2.2
Java Standard Edition

org.restlet.ext.xstream
Class XstreamConverter

java.lang.Object
  extended by org.restlet.engine.Helper
      extended by org.restlet.engine.converter.ConverterHelper
          extended by org.restlet.ext.xstream.XstreamConverter

public class XstreamConverter
extends ConverterHelper

Converter between the XML/JSON and Representation classes based on XStream.

SECURITY WARNING: XStream applies various techniques under the hood to ensure it is able to handle all types of objects. This includes using undocumented Java features and reflection. The XML generated by XStream includes all information required to build objects of almost any type. This introduces a potential security problem.
The XML provided to XStream for conversion to a Java object can be manipulated to inject objects into the unmarshalled object graph, which were not present at marshalling time. An attacker could exploit this to execute arbitrary code or shell commands in the context of the server running the XStream process. This issue has been addressed and is clearly documented here: XStream Security Framework.
You can configure the Xstream object used by this converter by overriding the createXstream(MediaType, Class) method and apply your own security permissions, and provide this new converter to the Restlet Engine (see org.restlet.engine.Engine#getRegisteredConverters method).

Author:
Jerome Louvel

Constructor Summary
XstreamConverter()
          Constructor.
 
Method Summary
protected
<T> XstreamRepresentation<T>
create(MediaType mediaType, T source)
          Creates the marshaling XstreamRepresentation.
protected
<T> XstreamRepresentation<T>
create(Representation source, Class<T> target)
          Creates the unmarshaling XstreamRepresentation.
<T> XStream
createXstream(MediaType mediaType, Class<T> target)
          Creates an XStream object based on a media type.
 Class<? extends HierarchicalStreamDriver> getJsonDriverClass()
          Returns the XStream JSON driver class.
 List<Class<?>> getObjectClasses(Variant source)
           
 List<VariantInfo> getVariants(Class<?> source)
           
 Class<? extends HierarchicalStreamDriver> getXmlDriverClass()
          Returns the XStream XML driver class.
 float score(Object source, Variant target, Resource resource)
           
<T> float
score(Representation source, Class<T> target, Resource resource)
           
 void setJsonDriverClass(Class<? extends HierarchicalStreamDriver> jsonDriverClass)
          Sets the XStream JSON driver class.
 void setXmlDriverClass(Class<? extends HierarchicalStreamDriver> xmlDriverClass)
          Sets the XStream XML driver class.
<T> T
toObject(Representation source, Class<T> target, Resource resource)
           
 Representation toRepresentation(Object source, Variant target, Resource resource)
           
<T> void
updatePreferences(List<Preference<MediaType>> preferences, Class<T> entity)
           
 
Methods inherited from class org.restlet.engine.converter.ConverterHelper
addObjectClass, addVariant, addVariants, getVariants, updatePreferences
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

XstreamConverter

public XstreamConverter()
Constructor.

Method Detail

create

protected <T> XstreamRepresentation<T> create(MediaType mediaType,
                                              T source)
Creates the marshaling XstreamRepresentation.

Type Parameters:
T -
Parameters:
mediaType - The target media type.
source - The source object to marshal.
Returns:
The marshaling XstreamRepresentation.

create

protected <T> XstreamRepresentation<T> create(Representation source,
                                              Class<T> target)
                                   throws IOException
Creates the unmarshaling XstreamRepresentation.

Type Parameters:
T -
Parameters:
source - The source representation to unmarshal.
target - The expected class of the Java object.
Returns:
The unmarshaling XstreamRepresentation.
Throws:
IOException

createXstream

public <T> XStream createXstream(MediaType mediaType,
                                 Class<T> target)
                      throws IOException
Creates an XStream object based on a media type. By default, it creates a HierarchicalStreamDriver or a DomDriver. To be overriden in order to customize security permissions.

Type Parameters:
T -
Parameters:
mediaType - The serialization media type.
target - The expected class of the Java object.
Returns:
The XStream object.
Throws:
IOException

getJsonDriverClass

public Class<? extends HierarchicalStreamDriver> getJsonDriverClass()
Returns the XStream JSON driver class.

Returns:
TXStream JSON driver class.

getObjectClasses

public List<Class<?>> getObjectClasses(Variant source)
Specified by:
getObjectClasses in class ConverterHelper

getVariants

public List<VariantInfo> getVariants(Class<?> source)
Specified by:
getVariants in class ConverterHelper

getXmlDriverClass

public Class<? extends HierarchicalStreamDriver> getXmlDriverClass()
Returns the XStream XML driver class.

Returns:
The XStream XML driver class.

score

public float score(Object source,
                   Variant target,
                   Resource resource)
Specified by:
score in class ConverterHelper

score

public <T> float score(Representation source,
                       Class<T> target,
                       Resource resource)
Specified by:
score in class ConverterHelper

setJsonDriverClass

public void setJsonDriverClass(Class<? extends HierarchicalStreamDriver> jsonDriverClass)
Sets the XStream JSON driver class.

Parameters:
jsonDriverClass - The XStream JSON driver class.

setXmlDriverClass

public void setXmlDriverClass(Class<? extends HierarchicalStreamDriver> xmlDriverClass)
Sets the XStream XML driver class.

Parameters:
xmlDriverClass - The XStream XML driver class.

toObject

public <T> T toObject(Representation source,
                      Class<T> target,
                      Resource resource)
           throws IOException
Specified by:
toObject in class ConverterHelper
Throws:
IOException

toRepresentation

public Representation toRepresentation(Object source,
                                       Variant target,
                                       Resource resource)
Specified by:
toRepresentation in class ConverterHelper

updatePreferences

public <T> void updatePreferences(List<Preference<MediaType>> preferences,
                                  Class<T> entity)
Overrides:
updatePreferences in class ConverterHelper

Restlet Framework 2.2.2
Java Standard Edition

Copyright © 2005-2014 Restlet.