-
Class Summary
Class |
Description |
XstreamConverter |
Deprecated
Use an XML serialization technology such as Jackson instead.
|
XstreamRepresentation<T> |
Deprecated
Use an XML serialization technology such as Jackson instead.
|
Package org.restlet.ext.xstream Description
Integration with XStream 1.4. XStream is a simple library to serialize objects to XML and back again.
It also supports JSON via a dependency on Jettison, a Stax driver for JSON.
SECURITY WARNING: XStream applies various techniques under the hood to ensure it is able to handle all types of objects.
This includes using undocumented Java features and reflection. The XML generated by XStream includes all information
required to build objects of almost any type. This introduces a potential security problem.
The XML provided to XStream for conversion to a Java object can be manipulated to inject objects into the unmarshalled
object graph, which were not present at marshalling time. An attacker could exploit this to execute arbitrary code or
shell commands in the context of the server running the XStream process. This issue has been addressed and is clearly
documented here:
XStream Security Framework.
You can customize the Xstream object used by any instance of XStreamRepresentation class, by overriding the createXStream
or call the getXStream method sand apply security permissions.
- Since:
- Restlet 2.0
- See Also:
- XStream Web site,
User Guide - XStream extension,
XStream Security Framework