Bump xstream from 1.4.10 to 1.4.19 in /services/id/service

Whitelist the required id generator classes, as xstream has switched to a default whitelist instead of a default blacklist.

diff --git a/services/id/service/pom.xml b/services/id/service/pom.xml
index 4e85b3a8cd64b9a1bfe5838be991c69fc1dff92f..494c4d1c8d6cf1daf34c5cee7342f3eb8cd995ad 100644 (file)
--- a/services/id/service/pom.xml
+++ b/services/id/service/pom.xml
@@ -64,7 +64,7 @@
     <dependency>
       <groupId>com.thoughtworks.xstream</groupId>
       <artifactId>xstream</artifactId>
-      <version>1.4.10</version>
+      <version>1.4.19</version>
     </dependency>
 
   </dependencies>

diff --git a/services/id/service/src/main/java/org/collectionspace/services/id/IDGeneratorSerializer.java b/services/id/service/src/main/java/org/collectionspace/services/id/IDGeneratorSerializer.java
index fc0c57567b5ba94d28c9a16a421c888987685ab0..4f455500c7db095400a5d34e2ff96c9ada069884 100644 (file)
--- a/services/id/service/src/main/java/org/collectionspace/services/id/IDGeneratorSerializer.java
+++ b/services/id/service/src/main/java/org/collectionspace/services/id/IDGeneratorSerializer.java
@@ -14,7 +14,7 @@
  * You may obtain a copy of the ECL 2.0 License at
  * https://source.collectionspace.org/collection-space/LICENSE.txt
  */
- 
+
 // @TODO: Revise exception handling to return custom Exceptions,
 // perhaps mirroring the subset of HTTP status codes returned.
 //
@@ -28,6 +28,8 @@ import com.thoughtworks.xstream.XStreamException;
 import com.thoughtworks.xstream.io.xml.DomDriver;
 
 import org.collectionspace.services.common.document.BadRequestException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 
 /**
@@ -39,11 +41,12 @@ import org.collectionspace.services.common.document.BadRequestException;
  * $LastChangedDate$
  */
 public class IDGeneratorSerializer {
+  static final Logger logger = LoggerFactory.getLogger(IDGeneratorSerializer.class);
 
   //////////////////////////////////////////////////////////////////////
   /**
    * Constructor (no-argument).
-   */ 
+   */
   public void IDGeneratorSerializer() {
   }
 
@@ -60,13 +63,13 @@ public class IDGeneratorSerializer {
    */
        public static String serialize(SettableIDGenerator generator)
            throws BadRequestException {
-       
+
          if (generator == null) {
            throw new BadRequestException("ID generator cannot be null.");
          }
-  
-    XStream xstream = new XStream(new DomDriver()); 
-    
+
+    XStream xstream = new XStream(new DomDriver());
+
     String serializedGenerator = "";
     try {
       serializedGenerator = xstream.toXML(generator);
@@ -74,9 +77,9 @@ public class IDGeneratorSerializer {
            throw new BadRequestException(
              "Could not convert ID generator to XML for storage in database.");
     }
-    
+
     return serializedGenerator;
-  
+
   }
 
   //////////////////////////////////////////////////////////////////////
@@ -99,16 +102,21 @@ public class IDGeneratorSerializer {
 
     XStream xstream = new XStream(new DomDriver());
 
+    xstream.allowTypeHierarchy(IDGenerator.class);
+    xstream.allowTypeHierarchy(IDGeneratorPart.class);
+
     SettableIDGenerator generator;
     try {
       generator = (SettableIDGenerator) xstream.fromXML(serializedGenerator);
     } catch (XStreamException e) {
+      logger.error(e.getMessage(), e);
+
            throw new BadRequestException(
              "Could not understand or parse this representation of an ID generator.", e);
     }
 
     return generator;
-  
+
   }
-  
+
 }