Update to latest XStream and add security calls (#1085)

Signed-off-by: Chris Jackson <[email protected]>
zsmartsystems · Jul 19, 2020 · 6a2bf25 · 6a2bf25
1 parent 5b4b9ff
commit 6a2bf25
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/com.zsmartsystems.zigbee.console.main/pom.xml b/com.zsmartsystems.zigbee.console.main/pom.xml
@@ -83,7 +83,7 @@
 		<dependency>
 			<groupId>com.thoughtworks.xstream</groupId>
 			<artifactId>xstream</artifactId>
-			<version>1.4.10</version>
+			<version>1.4.12</version>
 		</dependency>
 
 	</dependencies>

diff --git a/...bee.console.main/src/main/java/com/zsmartsystems/zigbee/console/main/ZigBeeDataStore.java b/...bee.console.main/src/main/java/com/zsmartsystems/zigbee/console/main/ZigBeeDataStore.java
@@ -63,6 +63,7 @@ public ZigBeeDataStore(String networkId) {
     private XStream openStream() {
         try {
             XStream stream = new XStream(new StaxDriver());
+            XStream.setupDefaultSecurity(stream);
             stream.alias("ZigBeeKey", ZigBeeKey.class);
             stream.alias("ZigBeeNode", ZigBeeNodeDao.class);
             stream.alias("ZigBeeEndpoint", ZigBeeEndpointDao.class);
@@ -80,6 +81,11 @@ private XStream openStream() {
             // stream.registerLocalConverter(ZigBeeKey.class, "address", new IeeeAddressConverter());
             // stream.registerLocalConverter(BindingTable.class, "srcAddr", new IeeeAddressConverter());
             // stream.registerLocalConverter(BindingTable.class, "dstAddr", new IeeeAddressConverter());
+
+            stream.allowTypesByWildcard(new String[] {
+                    "com.zsmartsystems.zigbee.**"
+            });
+
             return stream;
         } catch (Exception e) {
             logger.debug("Error opening XStream ", e);