Xsteam转换成JavaBean(SpringBoot遇到的问题)

public class XsteamUtil {
    public static Object toBean(Class<?> clazz, String xml) {
        Object xmlObject = null;
        XStream xstream = new XStream();
        //XStream.setupDefaultSecurity(xstream);
        //Class<?>[] classes = new Class[] { UnSubscribeV2Rsp.class, UsedCDRAuthReq.class };
        //xstream.allowTypes(classes);
        xstream.processAnnotations(clazz);
        xstream.autodetectAnnotations(true);
        //xstream.setClassLoader(UnSubscribeV2Rsp.class.getClassLoader());
        xmlObject= xstream.fromXML(xml);
        return xmlObject;
    }

}

异常 1：

Security framework of XStream not initialized, XStream is probably vulnerable.

意思是：xstream 的安全框架没有初始化，xstream 容易受攻击。

解决方法：xStream对象设置默认安全防护，同时设置允许的类

XStream.setupDefaultSecurity(xstream);
//UnSubscribeV2Rsp ,UsedCDRAuthReq (自己需要转换的JavaBean)
Class<?>[] classes = new Class[] { UnSubscribeV2Rsp.class, UsedCDRAuthReq.class };
xstream.allowTypes(classes);

异常 2： java.lang.ClassCastException: (明明类型一样，报转换异常)

在SpringBoot项目中，使用Xstream反序列化xml成实体类时，会发生明明是同种类型，在实际使用时却出现java.lang.ClassCastException的异常。

原因

因为springboot项目中不是使用的默认classloader。

解决方法

手动重设xtream的classloader

xstream.setClassLoader(UnSubscribeV2Rsp.class.getClassLoader());

加上解决问题：

public class XsteamUtil {
    public static Object toBean(Class<?> clazz, String xml) {
        Object xmlObject = null;
        XStream xstream = new XStream();
        XStream.setupDefaultSecurity(xstream);
        Class<?>[] classes = new Class[] { UnSubscribeV2Rsp.class, UsedCDRAuthReq.class };
        xstream.allowTypes(classes);
        xstream.processAnnotations(clazz);
        xstream.autodetectAnnotations(true);
        xstream.setClassLoader(UnSubscribeV2Rsp.class.getClassLoader());
        xmlObject= xstream.fromXML(xml);
        return xmlObject;
    }

}