XStream学习手册

​​

一、前言

1、XStream官网

    http://x-stream.github.io

2、XStream是什么

    XStream是一个简单的基于Java的类库，用来将Java对象序列化成XML（JSON）或反序列化为对象(即：可以轻易的将Java对象和XML文档相互转换)

3、XSteam能干什么

    XStream在运行时使用Java反射机制对要进行序列化的对象树的结构进行探索，并不需要对对象作出修改。XStream可以序列化内部字段，包括私private和final字段，并且支持非公开类以及内部类。

    在缺省情况下，XStream不需要配置映射关系，对象和字段将映射为同名XML元素。但是当对象和字段名与XML中的元素名不同时，XStream支持指定别名。XStream支持以方法调用的方式，或是Java 标注的方式指定别名。

    XStream在进行数据类型转换时，使用系统缺省的类型转换器。同时，也支持用户自定义的类型转换器。

4、XStream特点

• 使用方便 - XStream的API提供了一个高层次外观，以简化常用的用例

• 无需创建映射 - XStream的API提供了默认的映射大部分对象序列化

• 性能  - XStream快速和低内存占用，适合于大对象图或系统

• 干净的XML  - XStream创建一个干净和紧凑XML结果，这很容易阅读

• 不需要修改对象 - XStream可序列化的内部字段，如private和final字段，支持非公开类和内部类。默认构造函数不是强制性的要求

• 完整对象图支持 - XStream允许保持在对象模型中遇到的重复引用，并支持循环引用

• 可自定义的转换策略 - 定制策略可以允许特定类型的定制被表示为XML的注册

• 安全框架 - XStream提供了一个公平控制有关解组的类型，以防止操纵输入安全问题

• 错误消息 - 出现异常是由于格式不正确的XML时，XStream抛出一个统一的例外，提供了详细的诊断，以解决这个问题

• 另一种输出格式 - XStream支持其它的输出格式，如JSON

5、XStream常见的用途

    传输、持久化、配置、单元测试

二、XStream入门

1、添加XSteam依赖

<dependency>
    <groupId>com.thoughtworks.xstreamgroupId> <artifactId>xstreamartifactId> <version>1.4.12version> dependency> <dependency> <groupId>org.codehaus.jettisongroupId> <artifactId>jettisonartifactId> <version>1.4.1version> dependency>

2、XStream基本使用

package io.github.xstream.test01;
​
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.io.json.JettisonMappedXmlDriver;
import lombok.AllArgsConstructor;
import lombok.ToString; ​ public class XStreamTest01 { public static void main(String[] args) { Student student = new Student("张三", 20); XStream xStream = new XStream();//需要XPP3库 //XStream xStream = new XStream(new DomDriver());//不需要XPP3库 //XStream xStream = new XStream(new StaxDriver());//不需要XPP3库开始使用Java 6 //XML序列化 String xml = xStream.toXML(student); System.out.println(xml); //XML反序列化 student = (Student) xStream.fromXML(xml); System.out.println(student); ​ xStream = new XStream(new JettisonMappedXmlDriver()); xStream.setMode(XStream.NO_REFERENCES); //Json序列化 String json = xStream.toXML(student); System.out.println(json); //Json反序列 student = (Student) xStream.fromXML(json); System.out.println(student); } } ​ @AllArgsConstructor @ToString class Student { private String name; private int age; }

3、程序运行结果

  张三
  20

Security framework of XStream not initialized, XStream is probably vulnerable.
Student(name=张三, age=20)
{"io.github.xstream.test01.Student":{"name":"张三","age":20}}
Student(name=张三, age=20)
Security framework of XStream not initialized, XStream is probably vulnerable.

注意：文中使用到的Lombok注解，Lombok依赖自行添加；XStream序列化XML时需要引用的jar包：xstream-[version].jar、xpp3-[version].jar、xmlpull-[version].jar，当引入xstream依赖后会自动依赖xpp3、xmlpull依赖。XStream序列化JSON需要引用的jar包：jettison-[version].jar。

    使用XStream序列化时，对JavaBean没有任何限制。JavaBean的字段可以是私有的，也可以没有getter或setter方法，还可以没有默认的构造函数。

    XStream序列化XML时可以允许用户使用不同的XML解析器，用户可以使用一个标准的JAXP DOM解析器或自Java 6集成STAX解析器。这样用户就不需要依赖xpp3-[version].jar。

三、XStream混叠

1、混叠是一种技术来定制生成XML或者使用XStream特定的格式化XML。假设，一个下面的XML格式是用于序列化/反序列化Student对象。

<student name="张三">
    <phone> <brand>小米brand> <description>小米手机的描述description> phone> <phone> <brand>苹果brand> <description>苹果手机的描述description> phone> student>

2、根椐上面的XML格式，我们创建实体类

@AllArgsConstructor
@ToString
class Student { private String studentName; private List phones; } ​ @AllArgsConstructor @ToString class Phone { private String brand; private String description; }

3、执行代码

package io.github.xstream.test02;
​
import com.thoughtworks.xstream.XStream;
import lombok.AllArgsConstructor;
import lombok.ToString;
​
import java.util.ArrayList; import java.util.List; ​ public class XStreamTest02 { public static void main(String[] args) { List phones = new ArrayList<>(); phones.add(new Phone("小米手机", "小米手机的描述")); phones.add(new Phone("苹果手机", "苹果手机的描述")); Student student = new Student("张三", phones); ​ XStream xStream = new XStream();//需要XPP3库 //XML序列化 String xml = xStream.toXML(student); System.out.println(xml); } } ​ @AllArgsConstructor @ToString class Student { private String studentName; private List phones; } ​ @AllArgsConstructor @ToString class Phone { private String brand; private String description; }

4、验证输出

<io.github.xstream.test02.Student>
  <studentName>张三studentName> <phones> <io.github.xstream.test02.Phone> <brand>小米手机brand> <description>小米手机的描述description> io.github.xstream.test02.Phone> <io.github.xstream.test02.Phone> <brand>苹果手机brand> <description>苹果手机的描述description> io.github.xstream.test02.Phone> phones> io.github.xstream.test02.Student>

    在上面的结果，我们已经看到了Student对象名称是完全合格的。要替换它作为学生的标签，按照四、XStream类混叠的步骤

    另外，在上述结果中可以看出，所需studentName要重命名来命名。要替换它，按照五、XStream字段混叠的步骤

    在上面的结果，我们可以看到手机标记被添加成为手机列表。替换它，按照六、XStream隐式集合混叠的步骤

    在上面的结果，我们可以看到这个名字来作为一个子节点，需要将它作为根节点的属性。替换它，按照七、XStream属性混叠的步骤

四、XStream类混叠

1、类混叠是用来创建一个类的XML完全限定名称的别名。让我们修改XStreamTest02例子，将下面的代码添加到XStreamTest02例子里面

xStream.alias("student", Person02.class);
xStream.alias("phone", Phone.class);

2、执行代码

package io.github.xstream.test02;
​
import com.thoughtworks.xstream.XStream;
import lombok.AllArgsConstructor;
import lombok.ToString;
​
import java.util.ArrayList; import java.util.List; ​ public class XStreamTest02 { public static void main(String[] args) { List phones = new ArrayList<>(); phones.add(new Phone("小米手机", "小米手机的描述")); phones.add(new Phone("苹果手机", "苹果手机的描述")); Student student = new Student("张三", phones); ​ XStream xStream = new XStream();//需要XPP3库 xStream.alias("student", Student.class); xStream.alias("phone", Phone.class); ​ //XML序列化 String xml = xStream.toXML(student); System.out.println(xml); } } ​ @AllArgsConstructor @ToString class Student { private String studentName; private List phones; } ​ @AllArgsConstructor @ToString class Phone { private String brand; private String description; }

3、执行结果

<student>
  <studentName>张三studentName> <phones> <phone> <brand>小米手机brand> <description>小米手机的描述description> phone> <phone> <brand>苹果手机brand> <description>苹果手机的描述description> phone> phones> student>

可以看到和分别被修改为了和

五、XStream字段混叠

1、字段混叠用于创建以XML字段的别名。让我们再次修改原来的XStreamTest02例子，将下面的代码添加到XStreamTest02例子里面

xStream.aliasField("name", Student.class, "studentName");

2、执行代码

package io.github.xstream.test02;
​
import com.thoughtworks.xstream.XStream;
import lombok.AllArgsConstructor;
import lombok.ToString;
​
import java.util.ArrayList; import java.util.List; ​ public class XStreamTest02 { public static void main(String[] args) { List phones = new ArrayList<>(); phones.add(new Phone("小米手机", "小米手机的描述")); phones.add(new Phone("苹果手机", "苹果手机的描述")); Student student = new Student("张三", phones); ​ XStream xStream = new XStream();//需要XPP3库 xStream.alias("student", Student.class); xStream.alias("phone", Phone.class); xStream.aliasField("name", Student.class, "studentName"); ​ //XML序列化 String xml = xStream.toXML(student); System.out.println(xml); } } ​ @AllArgsConstructor @ToString class Student { private String studentName; private List phones; } ​ @AllArgsConstructor @ToString class Phone { private String brand; private String description; }

3、执行结果

<student>
  <name>张三name> <phones> <phone> <brand>小米手机brand> <description>小米手机的描述description> phone> <phone> <brand>苹果手机brand> <description>苹果手机的描述description> phone> phones> student>

可以看到被修改为了

六、XStream隐式集合混叠

1、隐式集合混叠时使用的集合是表示在XML无需显示根。例如，在我们的例子中，我们需要一个接一个，但不是在根节点来显示每一个节点。让我们再次修改原来的XStreamTest02例子，将下面的代码添加到XStreamTest02例子里面

xStream.addImplicitCollection(Student.class, "phones");

2、执行代码

package io.github.xstream.test02;
​
import com.thoughtworks.xstream.XStream;
import lombok.AllArgsConstructor;
import lombok.ToString;
​
import java.util.ArrayList; import java.util.List; ​ public class XStreamTest02 { public static void main(String[] args) { List phones = new ArrayList<>(); phones.add(new Phone("小米手机", "小米手机的描述")); phones.add(new Phone("苹果手机", "苹果手机的描述")); Student student = new Student("张三", phones); ​ XStream xStream = new XStream();//需要XPP3库 xStream.alias("student", Student.class); xStream.alias("phone", Phone.class); xStream.aliasField("name", Student.class, "studentName"); xStream.addImplicitCollection(Student.class, "phones"); ​ //XML序列化 String xml = xStream.toXML(student); System.out.println(xml); } } ​ @AllArgsConstructor @ToString class Student { private String studentName; private List phones; } ​ @AllArgsConstructor @ToString class Phone { private String brand; private String description; }

3、执行结果

<student>
  <name>张三name> <phone> <brand>小米手机brand> <description>小米手机的描述description> phone> <phone> <brand>苹果手机brand> <description>苹果手机的描述description> phone> student>

可以看到被隐藏了

七、XStream属性混叠

1、属性混叠用于创建一个成员变量作为XML属性序列化。让我们再次修改原来的XStreamTest02例子，将下面的代码添加到XStreamTest02例子里面

xStream.useAttributeFor(Student.class, "studentName");

2、执行代码

package io.github.xstream.test02;
​
import com.thoughtworks.xstream.XStream;
import lombok.AllArgsConstructor;
import lombok.ToString;
​
import java.util.ArrayList; import java.util.List; ​ public class XStreamTest02 { public static void main(String[] args) { List phones = new ArrayList<>(); phones.add(new Phone("小米手机", "小米手机的描述")); phones.add(new Phone("苹果手机", "苹果手机的描述")); Student student = new Student("张三", phones); ​ XStream xStream = new XStream();//需要XPP3库 xStream.alias("student", Student.class); xStream.alias("phone", Phone.class); xStream.aliasField("name", Student.class, "studentName"); xStream.addImplicitCollection(Student.class, "phones"); xStream.useAttributeFor(Student.class, "studentName"); ​ //XML序列化 String xml = xStream.toXML(student); System.out.println(xml); } } ​ @AllArgsConstructor @ToString class Student { private String studentName; private List phones; } ​ @AllArgsConstructor @ToString class Phone { private String brand; private String description; }

3、执行结果

<student name="张三">
  <phone> <brand>小米手机brand> <description>小米手机的描述description> phone> <phone> <brand>苹果手机brand> <description>苹果手机的描述description> phone> student>

可以看到被作为了的属性

八、XStream包混叠

1、包混叠用于创建一个类XML的完全限定名称的别名到一个新的限定名称。让我们再次修改原来的XStreamTest02例子，将下面代码

xStream.alias("student", Student.class);
xStream.alias("phone", Phone.class);

修改为

xStream.aliasPackage("xx.xx.xx.xx", "io.github.xstream.test02");

2、执行代码

package io.github.xstream.test02;
​
import com.thoughtworks.xstream.XStream;
import lombok.AllArgsConstructor;
import lombok.ToString;
​
import java.util.ArrayList; import java.util.List; ​ public class XStreamTest02 { public static void main(String[] args) { List phones = new ArrayList<>(); phones.add(new Phone("小米手机", "小米手机的描述")); phones.add(new Phone("苹果手机", "苹果手机的描述")); Student student = new Student("张三", phones); ​ XStream xStream = new XStream();//需要XPP3库 // xStream.alias("student", Student.class); // xStream.alias("phone", Phone.class); xStream.aliasPackage("xx.xx.xx.xx", "io.github.xstream.test02"); xStream.aliasField("name", Student.class, "studentName"); xStream.addImplicitCollection(Student.class, "phones"); xStream.useAttributeFor(Student.class, "studentName"); ​ //XML序列化 String xml = xStream.toXML(student); System.out.println(xml); } } ​ @AllArgsConstructor @ToString class Student { private String studentName; private List phones; } ​ @AllArgsConstructor @ToString class Phone { private String brand; private String description; }

3、执行结果

<xx.xx.xx.xx.Student name="张三">
  <xx.xx.xx.xx.Phone> <brand>小米手机brand> <description>小米手机的描述description> xx.xx.xx.xx.Phone> <xx.xx.xx.xx.Phone> <brand>苹果手机brand> <description>苹果手机的描述description> xx.xx.xx.xx.Phone> xx.xx.xx.xx.Student>

可以看到包名由io.github.xstream.test02替换为了xx.xx.xx.xx

九、XStream注解

1、前面的四、五、六、七、八步骤都是通过代码操作的

//xStream.alias("student", Student.class);
//xStream.alias("phone", Phone.class);
xStream.aliasPackage("xx.xx.xx.xx", "io.github.xstream.test02");
xStream.aliasField("name", Student.class, "studentName");
xStream.addImplicitCollection(Student.class, "phones");
xStream.useAttributeFor(Student.class, "studentName");

2、XStream同时也支持注解，使用注解会变得简单也会达到相同的效果

package io.github.xstream.test03;
​
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.annotations.*;
import com.thoughtworks.xstream.converters.basic.BooleanConverter;
import lombok.AllArgsConstructor; import lombok.Data; import lombok.ToString; ​ import java.util.ArrayList; import java.util.List; ​ public class XStreamTest03 { public static void main(String[] args) { List phones = new ArrayList<>(); phones.add(new Phone("小米手机", "小米手机的描述")); phones.add(new Phone("苹果手机", "苹果手机的描述")); Student student = new Student("张三", phones, 20, true); XStream xStream = new XStream();//需要XPP3库 //xStream.processAnnotations(new Class[]{Student.class}); xStream.autodetectAnnotations(true); //XML序列化 String xml = xStream.toXML(student); System.out.println(xml); } } ​ @AllArgsConstructor @ToString //别名注解 @XStreamAlias("student") class Student { @XStreamAlias("name") //把字段节点设置成属性 @XStreamAsAttribute private String studentName; //省略集合根节点 @XStreamImplicit private List phones; //隐藏字段 @XStreamOmitField private int age; //设置转换器 @XStreamConverter(value = BooleanConverter.class, booleans = {false}, strings = {"男", "女"}) private boolean sex; } ​ @AllArgsConstructor @ToString @XStreamAlias("phone") class Phone { private String brand; private String description; }

3、使用注解的话，需要XML序列化之前添加如下代码

xStream.autodetectAnnotations(true);

或者

xStream.processAnnotations(new Class[]{Student.class});

4、执行结果

<student name="张三">
  <phone> <brand>小米手机brand> <description>小米手机的描述description> phone> <phone> <brand>苹果手机brand> <description>苹果手机的描述description> phone> <sex>男sex> student>

使用注解我们也可以看到也能达到相同的效果

注意：当使用XStream对象处理一个被注解的类型时，XStream对象也会处理所有与其相关的类型的注解信息，即该类型的父类、父接口、所有子类的注解。

十、XStream自定义转换器

1、XStream自带的转换器

    XStream内部有许多转换器，用于JavaBean对象到XML或JSON之间的转换。这些转换器的详细信息网址：http://x-stream.github.io/converters.html

2、使用自定义转换器

package io.github.xstream.test04;
​
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.annotations.XStreamAlias;
import lombok.AllArgsConstructor;
import lombok.Getter; import lombok.Setter; import lombok.ToString; ​ public class XStreamTest04 { public static void main(String[] args) { Student student =new Student("张三",19); XStream xStream = new XStream(); //注册转换器 xStream.registerConverter(new StudentConverter()); //序列化 String xml = xStream.toXML(student); System.out.println(xml); //反序列化 student=(Student)xStream.fromXML(xml); System.out.println(student); } } ​ @Getter @Setter @ToString @AllArgsConstructor class Student { private String name; private int age; }

自定义转换器

package io.github.xstream.test04;
​
import com.thoughtworks.xstream.converters.Converter;
import com.thoughtworks.xstream.converters.MarshallingContext;
import com.thoughtworks.xstream.converters.UnmarshallingContext;
import com.thoughtworks.xstream.io.HierarchicalStreamReader; import com.thoughtworks.xstream.io.HierarchicalStreamWriter; ​ public class StudentConverter implements Converter { //定义转换器能转换的JavaBean类型 @Override public boolean canConvert(Class type) { return type.equals(Student.class); } ​ //把对象序列化成XML或JSON @Override public void marshal(Object value, HierarchicalStreamWriter writer, MarshallingContext context) { Student student = (Student) value; writer.startNode("姓名"); writer.setValue(student.getName()); writer.endNode(); writer.startNode("年龄"); writer.setValue(student.getAge() + ""); writer.endNode(); writer.startNode("转换器"); writer.setValue("自定义的转换器"); writer.endNode(); } ​ //把XML或JSON反序列化成对象 @Override public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { Student student = new Student("", -1); reader.moveDown(); student.setName(reader.getValue()); reader.moveUp(); reader.moveDown(); student.setAge(Integer.parseInt(reader.getValue())); reader.moveUp(); return student; } }

3、执行结果

  <姓名>张三
  <年龄>19
  <转换器>自定义的转换器

Security framework of XStream not initialized, XStream is probably vulnerable.
Student(name=张三, age=19)

4、常用的转换器接口与抽象类

SingleValueConverter：单值转换接口
AbstractSingleValueConverter：单值转换抽象类
Converter：常规转换器接口

十一、XStream对象流

1、对象输出流

package io.github.xstream.test05;
​
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.annotations.XStreamAlias;
import com.thoughtworks.xstream.annotations.XStreamAsAttribute;
import lombok.AllArgsConstructor; import lombok.ToString; ​ import java.io.*; ​ public class XStreamTest05 { public static void main(String[] args) throws IOException, ClassNotFoundException { XStreamTest05 xStreamTest04 = new XStreamTest05(); String path = "F:\\test.txt"; XStream xStream = new XStream();//需要XPP3库 xStream.processAnnotations(Student.class); xStream.autodetectAnnotations(true); xStreamTest04.writeObject(xStream, path); } ​ //对象输出流方法 public void writeObject(XStream xStream, String path) throws IOException { Student zs = new Student("张三", 20); Student ls = new Student("李四", 21); Student ww = new Student("王五", 22); ObjectOutputStream objectOutputStream = xStream.createObjectOutputStream(new FileOutputStream(path)); objectOutputStream.writeObject(zs); objectOutputStream.writeObject(ls); objectOutputStream.writeObject(ww); objectOutputStream.writeObject("totalStudent"); objectOutputStream.writeInt(3); objectOutputStream.close(); } } ​ @AllArgsConstructor @ToString //别名注解 @XStreamAlias("student") class Student { @XStreamAlias("name") //把字段节点设置成属性 @XStreamAsAttribute private String studentName; private int age; }

2、在指定路径中打开test.txt文件，查看执行结果

<object-stream>
  <student name="张三"> <age>20age> student> <student name="李四"> <age>21age> student> <student name="王五"> <age>22age> student> <string>totalStudentstring> <int>3int> object-stream>

注意：XStream对象流是通过标准java.io.ObjectOutputStream和java.io.ObjectInputStream对象。因为XML文档只能有一个根节点，必须包装在一个序列化的所有元素额外的根节点。这个根节点默认为上面的例子所示。 

3、对象输入流

package io.github.xstream.test05;
​
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.annotations.XStreamAlias;
import com.thoughtworks.xstream.annotations.XStreamAsAttribute;
import lombok.AllArgsConstructor; import lombok.ToString; ​ import java.io.*; ​ public class XStreamTest05 { public static void main(String[] args) throws IOException, ClassNotFoundException { XStreamTest05 xStreamTest04 = new XStreamTest05(); String path = "F:\\test.txt"; XStream xStream = new XStream();//需要XPP3库 xStream.processAnnotations(Student.class); xStream.autodetectAnnotations(true); xStreamTest04.readObject(xStream, path); } ​ //对象输入流方法 public void readObject(XStream xStream, String path) throws IOException, ClassNotFoundException { ObjectInputStream objectInputStream = xStream.createObjectInputStream(new FileInputStream(path)); System.out.println((Student) objectInputStream.readObject()); System.out.println((Student) objectInputStream.readObject()); System.out.println((Student) objectInputStream.readObject()); System.out.println(objectInputStream.readObject()); System.out.println(objectInputStream.readInt()); } } ​ @AllArgsConstructor @ToString //别名注解 @XStreamAlias("student") class Student { @XStreamAlias("name") //把字段节点设置成属性 @XStreamAsAttribute private String studentName; private int age; }

4、执行结果

Student(studentName=张三, age=20)
Student(studentName=李四, age=21)
Student(studentName=王五, age=22)
totalStudent
3

十二、XStream持久化API

1、保存Java对象

​package io.github.xstream.test06;
​
import com.thoughtworks.xstream.persistence.FilePersistenceStrategy;
import com.thoughtworks.xstream.persistence.PersistenceStrategy;
import com.thoughtworks.xstream.persistence.XmlArrayList;
import lombok.AllArgsConstructor; import lombok.ToString; ​ import java.io.File; import java.util.List; ​ public class XStreamTest06 { public static void main(String[] args) { XStreamTest06 xStreamTest06=new XStreamTest06(); xStreamTest06.saveObject(); } ​ //保存Java对象 public void saveObject(){ PersistenceStrategy strategy = new FilePersistenceStrategy(new File("F:\\")); List list = new XmlArrayList(strategy); list.add(new Student("张三",13)); list.add(new Student("李四",21)); list.add(new Student("王五",17)); } } ​ @ToString @AllArgsConstructor class Student { private String name; private int age; }

2、运行程序结果，在F磁盘的根路径可以看到有三个文件:[email protected]、[email protected]、[email protected]，每个对象都被序列化到XML文件里

3、读取并删除JavaBean对象

package io.github.xstream.test06;
​
import com.thoughtworks.xstream.persistence.FilePersistenceStrategy;
import com.thoughtworks.xstream.persistence.PersistenceStrategy;
import com.thoughtworks.xstream.persistence.XmlArrayList;
import lombok.AllArgsConstructor; import lombok.ToString; ​ import java.io.File; import java.util.Iterator; import java.util.List; ​ public class XStreamTest06 { public static void main(String[] args) { XStreamTest06 xStreamTest06 = new XStreamTest06(); xStreamTest06.deleteObject(); } //读取并删除Java对象 public void deleteObject() { PersistenceStrategy strategy = new FilePersistenceStrategy(new File("F:\\")); List list = new XmlArrayList(strategy); for (Iterator it = list.iterator(); it.hasNext(); ) { System.out.println((Student) it.next()); //删除对象序列化文件 it.remove(); } } } ​ @ToString @AllArgsConstructor class Student { private String name; private int age; }

4、运行程序结果，可以看到把F磁盘的根路径[email protected]、[email protected]、[email protected]文件删除了

Security framework of XStream not initialized, XStream is probably vulnerable.
Student(name=张三, age=13)
Student(name=李四, age=21)
Student(name=王五, age=17)

十三、XStream操作JSON

1、XStream序列化JSON的重命名

package io.github.xstream.test07;
​
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.annotations.XStreamAlias;
import com.thoughtworks.xstream.io.json.JettisonMappedXmlDriver;
import io.github.xstream.test04.StudentConverter; import lombok.AllArgsConstructor; import lombok.Getter; import lombok.Setter; import lombok.ToString; ​ public class XStreamTest07 { public static void main(String[] args) { XStreamTest07 xStreamTest07 = new XStreamTest07(); xStreamTest07.serializeJson(); } ​ public void serializeJson() { Student student = new Student("张三", 19); XStream xStream = new XStream(new JettisonMappedXmlDriver());//设置Json解析器 xStream.autodetectAnnotations(true); //JSON序列化 String xml = xStream.toXML(student); System.out.println(xml); //JSON反序列化 student = (Student) xStream.fromXML(xml); System.out.println(student); } } ​ @ToString @AllArgsConstructor @XStreamAlias("人") class Student { @XStreamAlias("姓名") private String name; @XStreamAlias("年龄") private int age; }

2、运行结果

{"人":{"姓名":"张三","年龄":19}}
Student(name=张三, age=19)
Security framework of XStream not initialized, XStream is probably vulnerable.

注意：XStream序列化JSON的重命名的方式与其序列化成XML的方式一样！

3、去掉序列化JSON的根节点

​package io.github.xstream.test07;
​
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.annotations.XStreamAlias;
import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
import com.thoughtworks.xstream.io.json.JettisonMappedXmlDriver; import com.thoughtworks.xstream.io.json.JsonHierarchicalStreamDriver; import com.thoughtworks.xstream.io.json.JsonWriter; import io.github.xstream.test04.StudentConverter; import lombok.AllArgsConstructor; import lombok.Getter; import lombok.Setter; import lombok.ToString; ​ import java.io.Writer; ​ public class XStreamTest07 { public static void main(String[] args) { XStreamTest07 xStreamTest07 = new XStreamTest07(); xStreamTest07.removeRootNode(); } ​ public void removeRootNode() { Student student = new Student("张三", 19); XStream xStream = new XStream(new JsonHierarchicalStreamDriver() { public HierarchicalStreamWriter createWriter(Writer writer) { return new JsonWriter(writer, JsonWriter.DROP_ROOT_MODE); } }); //Json序列化 String xml = xStream.toXML(student); System.out.println(xml); } } ​ @ToString @AllArgsConstructor @XStreamAlias("人") class Student { @XStreamAlias("姓名") private String name; @XStreamAlias("年龄") private int age; }

4、运行结果

{
  "name": "张三",
  "age": 19
}

注意：去掉根节点后的JSON串是不能反序列化的，因为XStream不知道它的类型。

5、JSON的解析器区别

前面两个例子使用了不同的JSON解析器，这里说明他们的不同之处：

1. JettisonMappedXmlDriver：是支持序列化和反序列化Json的。

2. JsonHierarchicalStreamDriver：只支持序列化，不支持反序列化。

 

参考：

    http://x-stream.github.io

    https://www.yiibai.com/xstream

    https://www.cnblogs.com/LiZhiW/p/4313493.html

​

● 别在 Java 代码里乱打日志了，这才是正确的打日志姿势！

● 高可用Redis服务架构分析与搭建

● 8 种方案，帮你解决重复提交问题！请拿走

● IDEA 解决 Maven 依赖冲突的高能神器，这一篇够不够？

● 你连微服务的网关都说不清楚，还天天鼓捣着要把项目拆分微服务？

​