Restlet Framework 2.3.11
Google App Engine

Package org.restlet.ext.xstream

Deprecated.
Use an XML serialization technology such as Jackson instead.
Integration with XStream 1.4.

See: Description

Package org.restlet.ext.xstream Description

Integration with XStream 1.4. XStream is a simple library to serialize objects to XML and back again. It also supports JSON via a dependency on Jettison, a Stax driver for JSON.
SECURITY WARNING: XStream applies various techniques under the hood to ensure it is able to handle all types of objects. This includes using undocumented Java features and reflection. The XML generated by XStream includes all information required to build objects of almost any type. This introduces a potential security problem.
The XML provided to XStream for conversion to a Java object can be manipulated to inject objects into the unmarshalled object graph, which were not present at marshalling time. An attacker could exploit this to execute arbitrary code or shell commands in the context of the server running the XStream process. This issue has been addressed and is clearly documented here: XStream Security Framework.
You can customize the Xstream object used by any instance of XStreamRepresentation class, by overriding the createXStream or call the getXStream method sand apply security permissions.
Since:
Restlet 2.0
See Also:
XStream Web site, User Guide - XStream extension, XStream Security Framework
Restlet Framework 2.3.11
Google App Engine

Copyright © 2005-2017 Restlet.