[activemq] branch activemq-5.16.x updated: [AMQ-8348] Fix XmlMessageRenderer has the risk of XStream deserialization

[jb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jbonofre pushed a commit to branch activemq-5.16.x
in repository https://gitbox.apache.org/repos/asf/activemq.git


The following commit(s) were added to refs/heads/activemq-5.16.x by this push:
     new 0b28d92  [AMQ-8348] Fix XmlMessageRenderer has the risk of XStream deserialization
0b28d92 is described below

commit 0b28d92280215b6bbf73aba588ca8b9778c36f49
Author: xingrufei <xi...@sogou-inc.com>
AuthorDate: Thu Aug 5 15:50:28 2021 +0800

    [AMQ-8348] Fix XmlMessageRenderer has the risk of XStream deserialization
    
    (cherry picked from commit 099108239cc9fb81a8d1cbdc48467fe30ba6529c)
---
 .../src/main/java/org/apache/activemq/web/view/XmlMessageRenderer.java   | 1 +
 1 file changed, 1 insertion(+)

diff --git a/activemq-web/src/main/java/org/apache/activemq/web/view/XmlMessageRenderer.java b/activemq-web/src/main/java/org/apache/activemq/web/view/XmlMessageRenderer.java
index 10caf9b..bfa0a06 100644
--- a/activemq-web/src/main/java/org/apache/activemq/web/view/XmlMessageRenderer.java
+++ b/activemq-web/src/main/java/org/apache/activemq/web/view/XmlMessageRenderer.java
@@ -42,6 +42,7 @@ public class XmlMessageRenderer extends SimpleMessageRenderer {
     public XStream getXstream() {
         if (xstream == null) {
             xstream = new XStream();
+            XStream.setupDefaultSecurity(xstream);
         }
         return xstream;
     }