XStream 1.4.10 警告: Security framework of XStream not initialized, XStream is probably vulnerable

參考：www.fengyunxiao.cn

 

XStream 1.4.10 出現警告：Security framework of XStream not initialized, XStream is probably vulnerable.

意思是：xstream 的安全框架沒有初始化，xstream 容易受攻擊。

解決方法：xStream對象設置默認安全防護，同時設置允許的類

 

XStream xStream = new XStream();
XStream.setupDefaultSecurity(xStream);
xStream.allowTypes(new Class[]{Test.class, Test2.class}); // 要關聯的類

 

該警告應該只有新版的XStream會出現，感覺這種設計並不好。

參考：www.fengyunxiao.cn