了解具体用法的可以借鉴这篇文章

xstream运用，JAVA对象转xml，xml转JAVA对象-CSDN博客

目录

升级问题

异常报错信息1

com.thoughtworks.xstream.security.ForbiddenClassException

解决方法

需要降低限制权限

异常报错信息2

com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter$UnknownFieldException: No such field

解决方法

升级问题

我是xstream-1.4.8.jar升级到xstream-1.4.20.jar

异常报错信息1

com.thoughtworks.xstream.security.ForbiddenClassException

2024-06-05 09:53:24.216 [TID:9935dc2458744822b7a072c85bcfb52b.167.17175524032817531] INFO  [org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/ecard]] ERROR EcardPaymentCallbackPageController com.thoughtworks.xstream.security.ForbiddenClassException: com.tpaic.ecard.domain.sale.PayPackage
 com.thoughtworks.xstream.security.ForbiddenClassException: com.tpaic.ecard.domain.sale.PayPackage
	at com.thoughtworks.xstream.security.NoTypePermission.allows(NoTypePermission.java:26)
	at com.thoughtworks.xstream.mapper.SecurityMapper.realClass(SecurityMapper.java:74)
	at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
	at com.thoughtworks.xstream.mapper.CachingMapper.realClass(CachingMapper.java:47)
	at com.thoughtworks.xstream.core.util.HierarchicalStreams.readClassType(HierarchicalStreams.java:29)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:135)
	at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)
	at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1464)
	at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1441)
	at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1321)
	at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1312)

解决方法

需要降低限制权限

//原始代码
/*
     * 将XML报文转化为java对象
     */
    public static Object makeObjectFromXml(String docStr, Class[] classList) {
        XStream xstream = new XStream(new Dom4JDriver());
        xstream.processAnnotations(classList);
        return xstream.fromXML(docStr);
    }


//解决方法
/*
     * 将XML报文转化为java对象
     */
    public static Object makeObjectFromXml(String docStr, Class[] classList) {
        XStream xstream = new XStream(new Dom4JDriver());
        //由于对象默认开启安全防护，尽量限制最低权限
        xstream.addPermission(AnyTypePermission.ANY);
        xstream.processAnnotations(classList);
        return xstream.fromXML(docStr);
    }

异常报错信息2

com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter$UnknownFieldException: No such field

Exception in thread "main" com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter$UnknownFieldException: No such field com.yun.greedy.modules.util.xstream.Package.Sign
---- Debugging information ----
message             : No such field com.yun.greedy.modules.util.xstream.Package.Sign
field               : Sign
class               : com.yun.greedy.modules.util.xstream.Package
required-type       : com.yun.greedy.modules.util.xstream.Package
converter-type      : com.thoughtworks.xstream.converters.reflection.ReflectionConverter
path                : /Package/Sign
xpath               : /Package/Sign
version             : 1.4.20

解决方法

报错信息是报文的节点字段大于所转对象的字段，只需要在对应的字段上添加下报文中的字段即可