@Test public void test_fromString_BillionLaughsAttack() throws IOException { String payload = IoUtils.getResourceAsString("/attack_BillionLaughsAttack.xml"); PippoRuntimeException exception = assertThrows(PippoRuntimeException.class, () -> { jaxbEngine.fromString(payload, Person.class); }); assertThat(exception.getMessage(), startsWith("Failed to deserialize content to '")); }
@Override @SuppressWarnings("unchecked") public <T> T fromString(String content, Class<T> classOfT) { try (StringReader reader = new StringReader(content)) { JAXBContext jaxbContext = JAXBContext.newInstance(classOfT); XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(reader); Unmarshaller unmarshaller = jaxbContext.createUnmarshaller(); return (T) unmarshaller.unmarshal(xmlStreamReader); } catch (JAXBException | XMLStreamException e) { throw new PippoRuntimeException(e, "Failed to deserialize content to '{}'", classOfT.getName()); } }
JaxbEngine implements ContentTypeEngine { @Override @SuppressWarnings("unchecked") public <T> T fromString(String content, Class<T> classOfT) { try (StringReader reader = new StringReader(content)) { JAXBContext jaxbContext = JAXBContext.newInstance(classOfT); XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(reader); Unmarshaller unmarshaller = jaxbContext.createUnmarshaller(); return (T) unmarshaller.unmarshal(xmlStreamReader); } catch (JAXBException | XMLStreamException e) { throw new PippoRuntimeException(e, "Failed to deserialize content to '{}'", classOfT.getName()); } } }
JaxbEngine implements ContentTypeEngine { @Override @SuppressWarnings("unchecked") public <T> T fromString(String content, Class<T> classOfT) { try (StringReader reader = new StringReader(content)) { JAXBContext jaxbContext = JAXBContext.newInstance(classOfT); XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(reader); Unmarshaller unmarshaller = jaxbContext.createUnmarshaller(); return (T) unmarshaller.unmarshal(xmlStreamReader); } catch (JAXBException | XMLStreamException e) { throw new PippoRuntimeException(e, "Failed to deserialize content to '{}'", classOfT.getName()); } } JaxbEngine(); }
JaxbEngine implements ContentTypeEngine { @Override @SuppressWarnings("unchecked") public <T> T fromString(String content, Class<T> classOfT) { try (StringReader reader = new StringReader(content)) { JAXBContext jaxbContext = JAXBContext.newInstance(classOfT); XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(reader); Unmarshaller unmarshaller = jaxbContext.createUnmarshaller(); return (T) unmarshaller.unmarshal(xmlStreamReader); } catch (JAXBException | XMLStreamException e) { throw new PippoRuntimeException(e, "Failed to deserialize content to '{}'", classOfT.getName()); } } JaxbEngine(); @Override void init(Application application); @Override String getContentType(); @Override String toString(Object object); @Override @SuppressWarnings("unchecked") T fromString(String content, Class<T> classOfT); }
JaxbEngine implements ContentTypeEngine { @Override @SuppressWarnings("unchecked") public <T> T fromString(String content, Class<T> classOfT) { try (StringReader reader = new StringReader(content)) { JAXBContext jaxbContext = JAXBContext.newInstance(classOfT); XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(reader); Unmarshaller unmarshaller = jaxbContext.createUnmarshaller(); return (T) unmarshaller.unmarshal(xmlStreamReader); } catch (JAXBException | XMLStreamException e) { throw new PippoRuntimeException(e, "Failed to deserialize content to '{}'", classOfT.getName()); } } JaxbEngine(); @Override void init(Application application); @Override String getContentType(); @Override String toString(Object object); @Override @SuppressWarnings("unchecked") T fromString(String content, Class<T> classOfT);  }