// Struts2 REST plugin XStreamHandler.toObject() pre-CVE-2017-9805.
// XStream deserialises XML from HTTP requests with NO type whitelist.

package org.apache.struts2.rest.handler;

import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.io.xml.DomDriver;

import java.io.InputStream;
import java.io.Reader;

public class XStreamHandler {

    private final XStream xstream;

    public XStreamHandler() {
        // BUG: default XStream constructor permits *every* Java class to be
        // instantiated from XML, including ProcessBuilder, dynamic proxies,
        // and the entire XStream gadget chain.
        this.xstream = new XStream(new DomDriver());
    }

    public Object toObject(Reader in, Class<?> clazz) {
        // No allowlist/security framework configured.
        // Attacker-controlled XML drives object graph instantiation.
        return xstream.fromXML(in);
    }

    public Object toObject(InputStream in, Class<?> clazz) {
        return xstream.fromXML(in);
    }
}