Caused by: com.thoughtworks.xstream.security.ForbiddenClassException: - Spring Batch

Question

I followed link: Caused by: java.lang.NullPointerException: Cannot invoke "com.thoughtworks.xstream.XStream.fromXML(String)" because "this.xstream" is null , but still don't have access.

Error:

[StepExecution: id=1, version=2, name=step1, status=FAILED, exitStatus=FAILED, readCount=0, filterCount=0, writeCount=0 readSkipCount=0, writeSkipCount=0, processSkipCount=0, commitCount=0, rollbackCount=1, exitDescription=org.springframework.oxm.UnmarshallingFailureException: XStream unmarshalling exception; nested exception is com.thoughtworks.xstream.security.ForbiddenClassException: com.mkyong.model.Report
    at org.springframework.oxm.xstream.XStreamMarshaller.convertXStreamException(XStreamMarshaller.java:885)
    at org.springframework.oxm.xstream.XStreamMarshaller.doUnmarshal(XStreamMarshaller.java:863)
    at org.springframework.oxm.xstream.XStreamMarshaller.unmarshalXmlStreamReader(XStreamMarshaller.java:820)
    at org.springframework.oxm.xstream.XStreamMarshaller.unmarshalXmlEventReader(XStreamMarshaller.java:811)
    at org.springframework.oxm.support.AbstractMarshaller.unmarshalStaxSource(AbstractMarshaller.java:412)
    at org.springframework.oxm.support.AbstractMarshaller.unmarshal(AbstractMarshaller.java:355)
    at org.springframework.batch.item.xml.StaxEventItemReader.doRead(StaxEventItemReader.java:273)
    at org.springframework.batch.item.support.AbstractItemCountingItemStreamItemReader.read(AbstractItemCountingItemStreamItemReader.java:93)
    at org.springframework.batch.core.step.item.SimpleChunkProvider.doRead(SimpleChunkProvider.java:99)
    at org.springframework.batch.core.step.item.SimpleChunkProvider.read(SimpleChunkProvider.java:180)
    at org.springframework.batch.core.step.item.SimpleChunkProvider$1.doInIteration(SimpleChunkProvider.java:126)
    at org.springframework.batch.repeat.support.RepeatTemplate.getNextResult(RepeatTemplate.java:375)
    at org.springframework.batch.repeat.support.RepeatTemplate.executeInternal(RepeatTemplate.java:215)
    at org.springframework.batch.repeat.support.RepeatTemplate.iterate(RepeatTemplate.java:145)
    at org.springframework.batch.core.step.item.SimpleChunkProvider.provide(SimpleChunkProvider.java:118)
    at org.springframework.batch.core.step.item.ChunkOrientedTasklet.execute(ChunkOrientedTasklet.java:71)
    at org.springframework.batch.core.step.tasklet.TaskletStep$ChunkTransactionCallback.doInTransaction(TaskletStep.java:407)
    at org.springframework.batch.core.step.tasklet.TaskletStep$ChunkTransactionCallback.doInTransaction(TaskletStep.java:331)
    at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:140)
    at org.springframework.batch.core.step.tasklet.TaskletStep$2.doInChunkContext(TaskletStep.java:273)
    at org.springframework.batch.core.scope.context.StepContextRepeatCallback.doInIteration(StepContextRepeatCallback.java:82)
    at org.springframework.batch.repeat.support.RepeatTemplate.getNextResult(RepeatTemplate.java:375)
    at org.springframework.batch.repeat.support.RepeatTemplate.executeInternal(RepeatTemplate.java:215)
    at org.springframework.batch.repeat.support.RepeatTemplate.iterate(RepeatTemplate.java:145)
    at org.springframework.batch.core.step.tasklet.TaskletStep.doExecute(TaskletStep.java:258)
    at org.springframework.batch.core.step.AbstractStep.execute(AbstractStep.java:208)
    at org.springframework.batch.core.job.SimpleStepHandler.handleStep(SimpleStepHandler.java:152)
    at org.springframework.batch.core.job.flow.JobFlowExecutor.executeStep(JobFlowExecutor.java:68)
    at org.springframework.batch.core.job.flow.support.state.StepState.handle(StepState.java:68)
    at org.springframework.batch.core.job.flow.support.SimpleFlow.resume(SimpleFlow.java:169)
    at org.springframework.batch.core.job.flow.support.SimpleFlow.start(SimpleFlow.java:144)
    at org.springframework.batch.core.job.flow.FlowJob.doExecute(FlowJob.java:137)
    at org.springframework.batch.core.job.AbstractJob.execute(AbstractJob.java:320)
    at org.springframework.batch.core.launch.support.SimpleJobLauncher$1.run(SimpleJobLauncher.java:149)
    at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:50)
    at org.springframework.batch.core.launch.support.SimpleJobLauncher.run(SimpleJobLauncher.java:140)
    at com.mkyong.App.main(App.java:25)
Caused by: com.thoughtworks.xstream.security.ForbiddenClassException: com.mkyong.model.Report
    at com.thoughtworks.xstream.security.NoTypePermission.allows(NoTypePermission.java:26)
    at com.thoughtworks.xstream.mapper.SecurityMapper.realClass(SecurityMapper.java:74)
    at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
    at com.thoughtworks.xstream.mapper.CachingMapper.realClass(CachingMapper.java:47)
    at com.thoughtworks.xstream.core.util.HierarchicalStreams.readClassType(HierarchicalStreams.java:29)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:135)
    at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)
    at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1421)
    at org.springframework.oxm.xstream.XStreamMarshaller.doUnmarshal(XStreamMarshaller.java:860)
    ... 35 more
]

job-report.xml

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:batch="http://www.springframework.org/schema/batch" xmlns:task="http://www.springframework.org/schema/task"
    xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/batch
        http://www.springframework.org/schema/batch/spring-batch.xsd
        http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/util 
        http://www.springframework.org/schema/util/spring-util.xsd">

    <batch:job id="reportJob">
        <batch:step id="step1">
            <batch:tasklet>
                <batch:chunk reader="xmlItemReader" writer="mongodbItemWriter" commit-interval="1">
                </batch:chunk>
            </batch:tasklet>
        </batch:step>
    </batch:job>

    <bean id="mongodbItemWriter" class="org.springframework.batch.item.data.MongoItemWriter">
        <property name="template" ref="mongoTemplate" />
        <property name="collection" value="report" />
    </bean>
    
    <bean id="xmlItemReader" class="org.springframework.batch.item.xml.StaxEventItemReader">
        <property name="fragmentRootElementName" value="record" />
        <property name="resource" value="classpath:xml/report.xml" />
        <property name="unmarshaller" ref="reportUnmarshaller" />
    </bean>

    <bean id="reportUnmarshaller" class="org.springframework.oxm.xstream.XStreamMarshaller">
        <property name=""></property>
        <property name="aliases">
            <util:map id="aliases">
                <entry key="record" value="com.mkyong.model.Report" />
                <!-- 
                <entry key="date" value="java.lang.String" />
                <entry key="impression" value="java.lang.Long" />
                <entry key="clicks" value="java.lang.Integer" />
                <entry key="earning" value="java.math.BigDecimal" />
                 -->
            </util:map>
        </property>
        <property name="converters">
            <array>
                <ref bean="reportConverter" />
            </array>
        </property>

    </bean>

    <bean id="reportConverter" class="com.mkyong.converter.ReportConverter" />

</beans>

context.xml

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="
        http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">

    <!-- stored job-meta in database
    <bean id="jobRepository"
        class="org.springframework.batch.core.repository.support.JobRepositoryFactoryBean">
        <property name="dataSource" ref="dataSource" />
        <property name="transactionManager" ref="transactionManager" />
        <property name="databaseType" value="mysql" />
    </bean>
    
    <bean id="transactionManager"
        class="org.springframework.batch.support.transaction.ResourcelessTransactionManager" />
    -->

    <!-- stored job-meta in memory --> 
    <bean id="jobRepository"
        class="org.springframework.batch.core.repository.support.MapJobRepositoryFactoryBean">
        <property name="transactionManager" ref="transactionManager" />
    </bean>
    
    <bean id="transactionManager"
        class="org.springframework.batch.support.transaction.ResourcelessTransactionManager" />
    
 
    <bean id="jobLauncher"
        class="org.springframework.batch.core.launch.support.SimpleJobLauncher">
        <property name="jobRepository" ref="jobRepository" />
    </bean>
</beans>

database.xml

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:mongo="http://www.springframework.org/schema/data/mongo" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/data/mongo
        http://www.springframework.org/schema/data/mongo/spring-mongo.xsd">

    <!-- connect to mongodb -->
    <mongo:mongo-client host="localhost" port="27017" />
    <mongo:db-factory dbname="yourdb" />
 
    <bean id="mongoTemplate" class="org.springframework.data.mongodb.core.MongoTemplate">
        <constructor-arg name="mongoDbFactory" ref="mongoDbFactory" />
    </bean>
</beans>

Report.java

@AllArgsConstructor
@NoArgsConstructor
@Data
@Builder
public class Report {
    private int id;
    private Date date;
    private long impression;
    private int clicks;
    private BigDecimal earning;
}

UPDATE-1:

<bean id="reportUnmarshaller" class="org.springframework.oxm.xstream.XStreamMarshaller">
        <property name="typePermissions" ref="reportConverter">
            <util:list value-type="com.thoughtworks.xstream.security.TypePermission">
                <array>
                    <value>TypePermission.ANY</value>
                </array>
            </util:list> 
        </property>
        <property name="aliases">
            <util:map id="aliases">
                <entry key="record" value="com.mkyong.model.Report" />
                <!-- 
                <entry key="date" value="java.lang.String" />
                <entry key="impression" value="java.lang.Long" />
                <entry key="clicks" value="java.lang.Integer" />
                <entry key="earning" value="java.math.BigDecimal" />
                 -->
            </util:map>
        </property>
        <property name="converters">
            <array>
                <ref bean="reportConverter" />
            </array>
        </property>

    </bean>

Answer 1

According to the error, you need to add com.mkyong.model.Report to the list of classes that are allowed to be deserialized by XStream. Here is a quick example in Java config (from Spring Batch's test suite ):

XStreamMarshaller unmarshaller = new XStreamMarshaller();
ExplicitTypePermission typePermission = new ExplicitTypePermission(new Class[] { Trade.class });
unmarshaller.setTypePermissions(typePermission);

You would need to do the equivalent in your XML config.

EDIT: Add sample with XML config

    <!--    define the type permission-->
    <bean id="typePermission" class="com.thoughtworks.xstream.security.ExplicitTypePermission">
        <constructor-arg value="com.mkyong.model.Report"/> <!-- string to array conversion automatically done by spring here -->
    </bean>

    <bean id="reportUnmarshaller" class="org.springframework.oxm.xstream.XStreamMarshaller">
        <property name="typePermissions" ref="typePermission"/>
        <property name="aliases">
            <util:map id="aliases">
                <entry key="record" value="com.mkyong.model.Report" />
                <!-- 
                <entry key="date" value="java.lang.String" />
                <entry key="impression" value="java.lang.Long" />
                <entry key="clicks" value="java.lang.Integer" />
                <entry key="earning" value="java.math.BigDecimal" />
                 -->
            </util:map>
        </property>
        <property name="converters">
            <array>
                <ref bean="reportConverter" />
            </array>
        </property>

    </bean>