Axon 4 XStream configuration

4
votes

When running my Spring Boot app which includes Axon 4 I see the following in my output console:

Security framework of XStream not initialized, XStream is probably vulnerable.

How do I go about securing the XStream included in Axon 4?

For clarification, I am speaking about how to configure the XStream that Axon 4 uses. I am not certain if this should be done in the YAML file or in one of the Configuration classes. Every where I have tried the information detailed in this answer does not affect the XStream configuration and I still get the same warning.

Update: Based on the answers below, this question seems to be two fold. Thanks to the answers below I managed to get this working as follows (based on information posted at this answer):

    //AxonConfig.java
    @Bean
    XStream xstream(){
        XStream xstream = new XStream();
        // clear out existing permissions and set own ones
        xstream.addPermission(NoTypePermission.NONE);
        // allow any type from the same package
        xstream.allowTypesByWildcard(new String[] {
                "com.ourpackages.**",
                "org.axonframework.**",
                "java.**",
                "com.thoughtworks.xstream.**"
        });

        return xstream;
    }

    @Bean
    @Primary
    public Serializer serializer(XStream xStream) {
        return XStreamSerializer.builder().xStream(xStream).build();
    }

I didn't want to answer my own question as I think Jan got the correct answer combined with Steven pointing to the Spring Boot config.

I am certain I will need to whittle away at the package scopes and will do so in due course. Thanks Jan and Steven for your assistance.

2
spring-bootaxon

2 Answers

3
votes

This is not Axon specific, check this question for background and solution: Security framework of XStream not initialized, XStream is probably vulnerable

2
votes

Jan Galinski is right in that this isn't an Axon specific issue per say. More so a shift within the XStream package. Regardless, the link Jan shares is very valuable.

From there, you can create your own XStream object, instead of using the one the XStreamSerializer creates for you when utilizing Axon. You can then feed that object to the builder() of the XStreamSerializer.

As you are using Spring Boot too, simply having a bean creation function like so would suffice:

// The XStream should be configured in such a way that a security solution is provided
@Bean
public Serializer serializer(XStream xStream) {
    return XStreamSerializer.builder().xStream(xStream).build();
}

Hope this helps!