Examples with WildcardTypePermission com.thoughtworks.xstream.security.WildcardTypePermission used on opensource projects

Example 1 with WildcardTypePermission

use of com.thoughtworks.xstream.security.WildcardTypePermission in project camel by apache.

the class XStreamUtils method addPermissions.

public static void addPermissions(XStream xstream, String permissions) {
    for (String pterm : permissions.split(",")) {
        boolean aod;
        pterm = pterm.trim();
        if (pterm.startsWith("-")) {
            aod = false;
            pterm = pterm.substring(1);
        } else {
            aod = true;
            if (pterm.startsWith("+")) {
                pterm = pterm.substring(1);
            }
        }
        TypePermission typePermission = null;
        if ("*".equals(pterm)) {
            // accept or deny any
            typePermission = AnyTypePermission.ANY;
        } else if (pterm.indexOf('*') < 0) {
            // exact type
            typePermission = new ExplicitTypePermission(new String[] { pterm });
        } else if (pterm.length() > 0) {
            // wildcard type
            typePermission = new WildcardTypePermission(new String[] { pterm });
        }
        if (typePermission != null) {
            if (aod) {
                xstream.addPermission(typePermission);
            } else {
                xstream.denyPermission(typePermission);
            }
        }
    }
}

Example 2 with WildcardTypePermission

use of com.thoughtworks.xstream.security.WildcardTypePermission in project jgnash by ccavanaugh.

the class AbstractXStreamContainer method configureXStream.

static XStream configureXStream(final XStreamJVM9 xstream) {
    // configure XStream security
    xstream.addPermission(NoTypePermission.NONE);
    xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
    xstream.addPermission(ArrayTypePermission.ARRAYS);
    xstream.addPermission(new WildcardTypePermission(new String[] { "java.**", "jgnash.engine.**" }));
    // gracefully ignore fields in the file that do not have object members
    xstream.ignoreUnknownElements();
    xstream.setMode(XStream.ID_REFERENCES);
    // use date instead of local-date by default
    xstream.alias("date", LocalDate.class);
    xstream.alias("Decimal", BigDecimal.class);
    xstream.alias("Account", Account.class);
    xstream.alias("RootAccount", RootAccount.class);
    xstream.alias("Budget", Budget.class);
    xstream.alias("BudgetGoal", BudgetGoal.class);
    xstream.alias("Config", Config.class);
    xstream.alias("CurrencyNode", CurrencyNode.class);
    xstream.alias("ExchangeRate", ExchangeRate.class);
    xstream.alias("ExchangeRateHistoryNode", ExchangeRateHistoryNode.class);
    xstream.alias("InvestmentTransaction", InvestmentTransaction.class);
    xstream.alias("BudgetPeriod", Period.class);
    xstream.alias("SecurityNode", SecurityNode.class);
    xstream.alias("SecurityHistoryNode", SecurityHistoryNode.class);
    xstream.alias("SecurityHistoryEvent", SecurityHistoryEvent.class);
    xstream.alias("Tag", Tag.class);
    xstream.alias("Transaction", Transaction.class);
    xstream.alias("TransactionEntry", TransactionEntry.class);
    xstream.alias("TransactionEntryAddX", TransactionEntryAddX.class);
    xstream.alias("TransactionEntryBuyX", TransactionEntryBuyX.class);
    xstream.alias("TransactionEntryDividendX", TransactionEntryDividendX.class);
    xstream.alias("TransactionEntryMergeX", TransactionEntryMergeX.class);
    xstream.alias("TransactionEntryReinvestDivX", TransactionEntryReinvestDivX.class);
    xstream.alias("TransactionEntryRemoveX", TransactionEntryRemoveX.class);
    xstream.alias("TransactionEntrySellX", TransactionEntrySellX.class);
    xstream.alias("TransactionEntrySplitX", TransactionEntrySplitX.class);
    xstream.useAttributeFor(Account.class, "placeHolder");
    xstream.useAttributeFor(Account.class, "locked");
    xstream.useAttributeFor(Account.class, "visible");
    xstream.useAttributeFor(Account.class, "name");
    xstream.useAttributeFor(Account.class, DESCRIPTION);
    xstream.useAttributeFor(Budget.class, DESCRIPTION);
    xstream.useAttributeFor(Budget.class, "name");
    xstream.useAttributeFor(Budget.class, "roundingScale");
    xstream.useAttributeFor(Budget.class, "roundingMode");
    xstream.useAttributeFor(Budget.class, "startMonth");
    xstream.useAttributeFor(CommodityNode.class, "symbol");
    xstream.useAttributeFor(CommodityNode.class, "scale");
    xstream.useAttributeFor(CommodityNode.class, "prefix");
    xstream.useAttributeFor(CommodityNode.class, "suffix");
    xstream.useAttributeFor(CommodityNode.class, DESCRIPTION);
    xstream.useAttributeFor(SecurityHistoryNode.class, "date");
    xstream.useAttributeFor(SecurityHistoryNode.class, "price");
    xstream.useAttributeFor(SecurityHistoryNode.class, "high");
    xstream.useAttributeFor(SecurityHistoryNode.class, "low");
    xstream.useAttributeFor(SecurityHistoryNode.class, "volume");
    xstream.useAttributeFor(SecurityHistoryEvent.class, "date");
    xstream.useAttributeFor(SecurityHistoryEvent.class, "type");
    xstream.useAttributeFor(SecurityHistoryEvent.class, "value");
    xstream.useAttributeFor(StoredObject.class, "uuid");
    xstream.useAttributeFor(Tag.class, "name");
    xstream.useAttributeFor(Tag.class, "color");
    xstream.useAttributeFor(Tag.class, "unicode");
    xstream.omitField(StoredObject.class, "markedForRemoval");
    // Ignore fields required for JPA
    xstream.omitField(StoredObject.class, "version");
    xstream.omitField(AmortizeObject.class, "id");
    xstream.omitField(BudgetGoal.class, "id");
    xstream.omitField(TransactionEntry.class, "id");
    xstream.omitField(ExchangeRateHistoryNode.class, "id");
    xstream.omitField(SecurityHistoryNode.class, "id");
    xstream.omitField(SecurityHistoryEvent.class, "id");
    // Filters out the hibernate
    xstream.registerConverter(new HibernateProxyConverter());
    xstream.registerConverter(new HibernatePersistentCollectionConverter(xstream.getMapper()));
    xstream.registerConverter(new HibernatePersistentMapConverter(xstream.getMapper()));
    return xstream;
}

Example 3 with WildcardTypePermission

use of com.thoughtworks.xstream.security.WildcardTypePermission in project drools by kiegroup.

the class XStreamUtils method internalCreateXStream.

/**
 * Vulnerable to CVE-210137285 variants. Do not use. Will be removed in the next few days!
 * @deprecated in favor of {@link #createTrustingXStream()} and {@link #createNonTrustingXStream()}
 */
@Deprecated
private static XStream internalCreateXStream(XStream xstream) {
    setupDefaultSecurity(xstream);
    xstream.addPermission(new WildcardTypePermission(new String[] { "java.**", "javax.**", "org.kie.**", "org.drools.**", "org.jbpm.**", "org.optaplanner.**", "org.appformer.**" }));
    return xstream;
}

Example 4 with WildcardTypePermission

use of com.thoughtworks.xstream.security.WildcardTypePermission in project camel by apache.

the class AbstractXStreamWrapper method addPermissions.

private static void addPermissions(XStream xstream, String permissions) {
    for (String pterm : permissions.split(",")) {
        boolean aod;
        pterm = pterm.trim();
        if (pterm.startsWith("-")) {
            aod = false;
            pterm = pterm.substring(1);
        } else {
            aod = true;
            if (pterm.startsWith("+")) {
                pterm = pterm.substring(1);
            }
        }
        TypePermission typePermission = null;
        if ("*".equals(pterm)) {
            // accept or deny any
            typePermission = AnyTypePermission.ANY;
        } else if (pterm.indexOf('*') < 0) {
            // exact type
            typePermission = new ExplicitTypePermission(new String[] { pterm });
        } else if (pterm.length() > 0) {
            // wildcard type
            typePermission = new WildcardTypePermission(new String[] { pterm });
        }
        if (typePermission != null) {
            if (aod) {
                xstream.addPermission(typePermission);
            } else {
                xstream.denyPermission(typePermission);
            }
        }
    }
}

Example 5 with WildcardTypePermission

use of com.thoughtworks.xstream.security.WildcardTypePermission in project drools by kiegroup.

the class XStreamUtils method internalCreateNonTrustingXStream.

/**
 * Use for XML or JSON that might not come from a trusted source (such as REST services payloads, ...).
 * Automatically allowlists all classes with an {@link XStreamAlias} annotation.
 * Often requires allowlisting additional domain specific classes, which you'll need to expose in your API's.
 */
private static XStream internalCreateNonTrustingXStream(XStream xstream) {
    setupDefaultSecurity(xstream);
    // TODO remove if setupDefaultSecurity already does this.
    // See comment in https://github.com/x-stream/xstream/pull/99
    xstream.addPermission(new AnyAnnotationTypePermission());
    xstream.addPermission(new WildcardTypePermission(ALLOWLISTED_PACKAGES));
    // Instead, embrace a allowlist approach and expose that in your API's.
    return xstream;
}