CVE-2018-1327

@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.rest.handler;
+
+import com.opensymphony.xwork2.ActionInvocation;
+import com.opensymphony.xwork2.XWorkTestCase;
+import com.opensymphony.xwork2.mock.MockActionInvocation;
+
+import java.io.Reader;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.io.Writer;
+import java.util.Arrays;
+
+import static org.fest.assertions.Assertions.assertThat;
+
+public class JacksonXmlHandlerTest extends XWorkTestCase {
+
+    private String xml;
+    private JacksonXmlHandler handler;
+    private ActionInvocation ai;
+
+    public void setUp() throws Exception {
+        super.setUp();
+        xml = "<SimpleBean>" +
+                "<name>Jan</name>" +
+                "<age>12</age>" +
+                "<parents>" +
+                "<parents>Adam</parents>" +
+                "<parents>Ewa</parents>" +
+                "</parents>" +
+                "</SimpleBean>";
+        handler = new JacksonXmlHandler();
+        ai = new MockActionInvocation();
+    }
+
+    public void testObjectToXml() throws Exception {
+        // given
+        SimpleBean obj = new SimpleBean();
+        obj.setName("Jan");
+        obj.setAge(12L);
+        obj.setParents(Arrays.asList("Adam", "Ewa"));
+
+        // when
+        Writer stream = new StringWriter();
+        handler.fromObject(ai, obj, null, stream);
+
+        // then
+        stream.flush();
+        assertEquals(xml, stream.toString());
+    }
+
+    public void testXmlToObject() throws Exception {
+        // given
+        SimpleBean obj = new SimpleBean();
+
+        // when
+        Reader in = new StringReader(xml);
+        handler.toObject(ai, in, obj);
+
+        // then
+        assertNotNull(obj);
+        assertEquals(obj.getName(), "Jan");
+        assertEquals(obj.getAge().longValue(), 12L);
+        assertNotNull(obj.getParents());
+        assertThat(obj.getParents())
+                .hasSize(2)
+                .containsExactly("Adam", "Ewa");
+    }
+
+}
\ No newline at end of file

@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.rest.handler;
+
+import java.util.List;
+
+public class SimpleBean {
+
+    private String name;
+    private Long age;
+    private List<String> parents;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public Long getAge() {
+        return age;
+    }
+
+    public void setAge(Long age) {
+        this.age = age;
+    }
+
+    public List<String> getParents() {
+        return parents;
+    }
+
+    public void setParents(List<String> parents) {
+        this.parents = parents;
+    }
+}

@@ -55,6 +55,11 @@
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-xml</artifactId>
+            <optional>true</optional>
+        </dependency>
 
         <dependency>
             <groupId>mockobjects</groupId>
@@ -80,6 +85,12 @@
             <optional>true</optional>
         </dependency>
 
+        <dependency>
+            <groupId>org.easytesting</groupId>
+            <artifactId>fest-assert</artifactId>
+            <scope>test</scope>
+        </dependency>
+
         <!-- The Servlet API mocks in Spring Framework 4.x only supports Servlet 3.0 and higher.
            This is only necessary in tests-->
         <dependency>

@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.rest.handler;
+
+import com.fasterxml.jackson.databind.ObjectReader;
+import com.fasterxml.jackson.dataformat.xml.XmlMapper;
+import com.opensymphony.xwork2.ActionInvocation;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import java.io.IOException;
+import java.io.Reader;
+import java.io.Writer;
+
+/**
+ * Handles XML content using Jackson
+ */
+public class JacksonXmlHandler extends AbstractContentTypeHandler {
+
+    private static final Logger LOG = LogManager.getLogger(JacksonXmlHandler.class);
+
+    private static final String DEFAULT_CONTENT_TYPE = "application/xml";
+    private XmlMapper mapper = new XmlMapper();
+
+    public void toObject(ActionInvocation invocation, Reader in, Object target) throws IOException {
+        LOG.debug("Converting input into an object of: {}", target.getClass().getName());
+        ObjectReader or = mapper.readerForUpdating(target);
+        or.readValue(in);
+    }
+
+    public String fromObject(ActionInvocation invocation, Object obj, String resultCode, Writer stream) throws IOException {
+        LOG.debug("Converting an object of {} into string", obj.getClass().getName());
+        mapper.writeValue(stream, obj);
+        return null;
+    }
+
+    public String getContentType() {
+        return DEFAULT_CONTENT_TYPE;
+    }
+
+    public String getExtension() {
+        return "xml";
+    }
+
+}

@@ -103,7 +103,7 @@
         <tiles.version>3.0.7</tiles.version>
         <tiles-request.version>1.0.6</tiles-request.version>
         <log4j2.version>2.10.0</log4j2.version>
-        <jackson.version>2.9.2</jackson.version>
+        <jackson.version>2.9.4</jackson.version>
 
         <!-- Site generation -->
         <fluido-skin.version>1.6</fluido-skin.version>
@@ -1064,7 +1064,12 @@
                 <artifactId>jackson-databind</artifactId>
                 <version>${jackson.version}</version>
             </dependency>
-
+            <dependency>
+                <groupId>com.fasterxml.jackson.dataformat</groupId>
+                <artifactId>jackson-dataformat-xml</artifactId>
+                <version>${jackson.version}</version>
+            </dependency>
+            
             <!-- CDI & Weld -->
             <dependency>
                 <groupId>javax.enterprise</groupId>