// Clean Java reference - secure XStream usage with explicit allowlist.
// Looks superficially similar to CVE-2017-9805 but configures typePermissions.

package com.example.safe;

import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.io.xml.DomDriver;
import com.thoughtworks.xstream.security.NoTypePermission;
import com.thoughtworks.xstream.security.NullPermission;
import com.thoughtworks.xstream.security.PrimitiveTypePermission;

import java.io.Reader;

public final class SafeXmlBinder {

    private final XStream xstream;

    public SafeXmlBinder(Class<?> allowedRoot) {
        this.xstream = new XStream(new DomDriver());

        // Lock down deserialisation to a deny-by-default allowlist.
        xstream.addPermission(NoTypePermission.NONE);
        xstream.addPermission(NullPermission.NULL);
        xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
        xstream.allowTypes(new Class<?>[] { allowedRoot });
        xstream.allowTypesByWildcard(new String[] {
            "com.example.dto.**",
        });
    }

    public Object fromXml(Reader in) {
        return xstream.fromXML(in);
    }
}