[AMQ-8348] XmlMessageRenderer has the risk of XStream deserialization

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 5.16.3, 5.17.0
• Component/s: Transport
• Assignee: Jean-Baptiste Onofré
• Reporter: Zixuan Liu
• Created: 05/Aug/21 07:27
• Updated: 06/Aug/21 05:19
• Resolved: 06/Aug/21 05:19

Description

XmlMessageRenderer.getXstream() method:

public XStream getXstream() {
 if (xstream == null) {
   xstream = new XStream();
 }
 return xstream;
}

There is a risk of XStream deserialization