[CAMEL-9297] Expose more configuration options from Camel's XStream

camel-core/src/main/java/org/apache/camel/model/dataformat/XStreamDataFormat.java

@@ -57,6 +57,8 @@ public class XStreamDataFormat extends DataFormatDefinition {
     private String driverRef;
     @XmlAttribute
     private String mode;
+    @XmlAttribute
+    private String permissions;
 
     @XmlJavaTypeAdapter(ConvertersAdapter.class)
     @XmlElement(name = "converters")
@@ -180,6 +182,17 @@ public void setImplicitCollections(Map<String, String[]> implicitCollections) {
         this.implicitCollections = implicitCollections;
     }
 
+    public String getPermissions() {
+        return permissions;
+    }
+
+    /**
+     * Adds permissionsList
+     */
+    public void setPermissions(String permissions) {
+        this.permissions = permissions;
+    }
+
     @Override
     protected DataFormat createDataFormat(RouteContext routeContext) {
         if ("json".equals(this.driver)) {
@@ -210,6 +223,9 @@ protected void configureDataFormat(DataFormat dataFormat, CamelContext camelCont
         if (this.implicitCollections != null) {
             setProperty(camelContext, dataFormat, "implicitCollections", this.implicitCollections);
         }
+        if (this.permissions != null) {
+            setProperty(camelContext, dataFormat, "permissions", this.permissions);
+        }
         if (this.mode != null) {
             setProperty(camelContext, dataFormat, "mode", mode);
         }
@@ -547,5 +563,4 @@ public String toString() {
             return "OmitField[" + clsName + ", fields=" + Arrays.asList(this.fields) + "]";
         }
     }
-
 }

components/camel-xstream/src/main/java/org/apache/camel/dataformat/xstream/AbstractXStreamWrapper.java

@@ -32,7 +32,10 @@
 import com.thoughtworks.xstream.io.HierarchicalStreamDriver;
 import com.thoughtworks.xstream.io.HierarchicalStreamReader;
 import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
-
+import com.thoughtworks.xstream.security.AnyTypePermission;
+import com.thoughtworks.xstream.security.ExplicitTypePermission;
+import com.thoughtworks.xstream.security.TypePermission;
+import com.thoughtworks.xstream.security.WildcardTypePermission;
 import org.apache.camel.CamelContext;
 import org.apache.camel.Exchange;
 import org.apache.camel.converter.jaxp.StaxConverter;
@@ -47,14 +50,17 @@
  * ({@link DataFormat}) interface which leverage the XStream library for XML or JSON's marshaling and unmarshaling
  */
 public abstract class AbstractXStreamWrapper extends ServiceSupport implements DataFormat, DataFormatName {
-
+    private static final String PERMISSIONS_PROPERTY_KEY = "org.apache.camel.xstream.permissions";
+    private static final String PERMISSIONS_PROPERTY_DEFAULT = "-*,java.lang.*,java.util.*";
+
     private XStream xstream;
     private HierarchicalStreamDriver xstreamDriver;
     private StaxConverter staxConverter;
     private List<String> converters;
     private Map<String, String> aliases;
     private Map<String, String[]> omitFields;
     private Map<String, String[]> implicitCollections;
+    private String permissions;
     private String mode;
 
     public AbstractXStreamWrapper() {
@@ -174,13 +180,59 @@ protected XStream createXStream(ClassResolver resolver, ClassLoader classLoader)
                 }
             }
 
+            addDefaultPermissions(xstream);
+            if (this.permissions != null) {
+                // permissions ::= pterm (',' pterm)*   # consits of one or more terms
+                // pterm       ::= aod? wterm           # each term preceded by an optional sign 
+                // aod         ::= '+' | '-'            # indicates allow or deny where allow if omitted
+                // wterm       ::= a class name with optional wildcard characters
+                addPermissions(xstream, permissions);
+            }
         } catch (Exception e) {
             throw new RuntimeException("Unable to build XStream instance", e);
         }
 
         return xstream;
     }
 
+    private static void addPermissions(XStream xstream, String permissions) {
+        for (String pterm : permissions.split(",")) {
+            boolean aod;
+            pterm = pterm.trim();
+            if (pterm.startsWith("-")) {
+                aod = false;
+                pterm = pterm.substring(1);
+            } else {
+                aod = true;
+                if (pterm.startsWith("+")) {
+                    pterm = pterm.substring(1);
+                }
+            }
+            TypePermission typePermission = null;
+            if ("*".equals(pterm)) {
+                // accept or deny any
+                typePermission = AnyTypePermission.ANY;
+            } else if (pterm.indexOf('*') < 0) {
+                // exact type
+                typePermission = new ExplicitTypePermission(new String[]{pterm});
+            } else if (pterm.length() > 0) {
+                // wildcard type
+                typePermission = new WildcardTypePermission(new String[]{pterm});
+            }
+            if (typePermission != null) {
+                if (aod) {
+                    xstream.addPermission(typePermission);
+                } else {
+                    xstream.denyPermission(typePermission);
+                }
+            }
+        }
+    }
+
+    private static void addDefaultPermissions(XStream xstream) {
+        addPermissions(xstream, System.getProperty(PERMISSIONS_PROPERTY_KEY, PERMISSIONS_PROPERTY_DEFAULT));
+    }
+
     protected int getModeFromString(String modeString) {
         int result;
         if ("NO_REFERENCES".equalsIgnoreCase(modeString)) {
@@ -252,6 +304,14 @@ public void setXstreamDriver(HierarchicalStreamDriver xstreamDriver) {
         this.xstreamDriver = xstreamDriver;
     }
 
+    public String getPermissions() {
+        return permissions;
+    }
+
+    public void setPermissions(String permissions) {
+        this.permissions = permissions;
+    }
+
     public String getMode() {
         return mode;
     }

components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/MarshalDomainObjectTest.java

@@ -19,13 +19,25 @@
 import org.apache.camel.builder.RouteBuilder;
 import org.apache.camel.component.mock.MockEndpoint;
 import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
 import org.junit.Test;
 
 /**
  * Marshal tests with domain objects.
  */
 public class MarshalDomainObjectTest extends CamelTestSupport {
 
+    @BeforeClass
+    public static void setup() {
+        XStreamTestUtils.setPermissionSystemProperty("");
+    }
+
+    @AfterClass
+    public static void cleanup() {
+        XStreamTestUtils.revertPermissionSystemProperty();
+    }
+
     @Test
     public void testMarshalDomainObject() throws Exception {
         MockEndpoint mock = getMockEndpoint("mock:result");

components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/UnmarshalThenMarshalTest.java

@@ -23,12 +23,25 @@
 import org.apache.camel.builder.RouteBuilder;
 import org.apache.camel.component.mock.MockEndpoint;
 import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
 import org.junit.Test;
 
 /**
  * @version 
  */
 public class UnmarshalThenMarshalTest extends CamelTestSupport {
+
+    @BeforeClass
+    public static void setup() {
+        XStreamTestUtils.setPermissionSystemProperty("");
+    }
+
+    @AfterClass
+    public static void cleanup() {
+        XStreamTestUtils.revertPermissionSystemProperty();
+    }
+
     @Test
     public void testSendXmlAndUnmarshal() throws Exception {
 

components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConcurrencyTest.java

@@ -22,13 +22,25 @@
 
 import org.apache.camel.builder.RouteBuilder;
 import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
 import org.junit.Test;
 
 /**
  * @version 
  */
 public class XStreamConcurrencyTest extends CamelTestSupport {
 
+    @BeforeClass
+    public static void setup() {
+        XStreamTestUtils.setPermissionSystemProperty("");
+    }
+
+    @AfterClass
+    public static void cleanup() {
+        XStreamTestUtils.revertPermissionSystemProperty();
+    }
+
     @Test
     public void testNoConcurrentProducers() throws Exception {
         doSendMessages(1, 1);

components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamConfigurationTest.java

@@ -33,6 +33,8 @@
 import org.apache.camel.component.mock.MockEndpoint;
 import org.apache.camel.model.dataformat.XStreamDataFormat;
 import org.apache.camel.test.junit4.CamelTestSupport;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
 import org.junit.Test;
 
 /**
@@ -42,6 +44,16 @@ public class XStreamConfigurationTest extends CamelTestSupport {
 
     private static volatile boolean constructorInjected;
     private static volatile boolean methodInjected;
+
+    @BeforeClass
+    public static void setup() {
+        XStreamTestUtils.setPermissionSystemProperty("");
+    }
+
+    @AfterClass
+    public static void cleanup() {
+        XStreamTestUtils.revertPermissionSystemProperty();
+    }
 
     @Override
     public void setUp() throws Exception {

components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatDriverConfigTest.java

@@ -18,7 +18,6 @@
 
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.io.json.JsonHierarchicalStreamDriver;
-import org.apache.camel.impl.DefaultClassResolver;
 import org.apache.camel.test.junit4.CamelTestSupport;
 import org.junit.Test;
 

components/camel-xstream/src/test/java/org/apache/camel/dataformat/xstream/XStreamDataFormatPermissionsSystemPropertyTest.java

@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.dataformat.xstream;
+
+import com.thoughtworks.xstream.XStream;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+public class XStreamDataFormatPermissionsSystemPropertyTest extends XStreamDataFormatPermissionsTest {
+
+    @BeforeClass
+    public static void setup() {
+        // clear the default permissions system property
+        // see AbstractXStreamWrapper.PERMISSIONS_PROPERTY_DEFAULT
+        XStreamTestUtils.setPermissionSystemProperty("");
+    }
+
+    @AfterClass
+    public static void cleanup() {
+        XStreamTestUtils.revertPermissionSystemProperty();
+    }
+
+    @Test
+    @Override
+    public void testNone() {
+        XStreamDataFormat xStreamDataFormat = new XStreamDataFormat();
+        XStream xStream = xStreamDataFormat.createXStream(context.getClassResolver(), context.getApplicationContextClassLoader());
+
+        Object po = xStream.fromXML(XML_PURCHASE_ORDER);
+        assertNotNull(po);
+    }
+}