ActiveMQ XStream ForbiddenClassException

Question

在我的java应用中，我使用ActiveMQ 5.16.2作为代理和客户端5.16.1。有时我会在一个循环中得到这个错误：

---- Debugging information ----
cause-exception     : com.thoughtworks.xstream.security.ForbiddenClassException
cause-message       : java.io.IOException
class               : org.apache.activemq.command.ExceptionResponse
required-type       : org.apache.activemq.command.ExceptionResponse
converter-type      : 
com.thoughtworks.xstream.converters.reflection.ReflectionConverter
path                : /org.apache.activemq.command.ExceptionResponse/exception
line number         : 5
version             : 1.4.15
-------------------------------
    at org.apache.activemq.util.IOExceptionSupport.create(IOExceptionSupport.java:34)
    at org.apache.activemq.transport.http.HttpClientTransport.run(HttpClientTransport.java:205)
    at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: com.thoughtworks.xstream.converters.ConversionException: 
---- Debugging information ----
cause-exception     : com.thoughtworks.xstream.security.ForbiddenClassException
cause-message       : java.io.IOException
class               : org.apache.activemq.command.ExceptionResponse
required-type       : org.apache.activemq.command.ExceptionResponse
converter-type      : com.thoughtworks.xstream.converters.reflection.ReflectionConverter
path                : /org.apache.activemq.command.ExceptionResponse/exception
line number         : 5
version             : 1.4.15
-------------------------------
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:77)
    at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:72)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:50)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:134)
    at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)
    at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1409)
    at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1388)
    at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1273)
    at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1264)
    at org.apache.activemq.transport.xstream.XStreamWireFormat.unmarshalText(XStreamWireFormat.java:66)
    at org.apache.activemq.transport.util.TextWireFormat.unmarshal(TextWireFormat.java:56)
    at org.apache.activemq.transport.http.HttpClientTransport.run(HttpClientTransport.java:196)
... 1 common frames omitted
Caused by: com.thoughtworks.xstream.security.ForbiddenClassException: java.io.IOException
   at com.thoughtworks.xstream.security.NoTypePermission.allows(NoTypePermission.java:26)
   at com.thoughtworks.xstream.mapper.SecurityMapper.realClass(SecurityMapper.java:74)
   at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
   at com.thoughtworks.xstream.mapper.CachingMapper.realClass(CachingMapper.java:47)
   at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.doUnmarshal(AbstractReflectionConverter.java:420)
   at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.unmarshal(AbstractReflectionConverter.java:277)
   at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
... 13 common frames omitted

当我在5.16.0和5.16.1中纠正时，我已经在这个XStream中遇到了类似的错误，但现在它是另一个错误。

我尝试使用5.16.2客户端，但得到相同的错误：

--- Debugging information ----
cause-exception     : 
com.thoughtworks.xstream.security.ForbiddenClassException
cause-message       : java.io.IOException
class               : org.apache.activemq.command.ExceptionResponse
required-type       : org.apache.activemq.command.ExceptionResponse
converter-type      : com.thoughtworks.xstream.converters.reflection.ReflectionConverter
path                : /org.apache.activemq.command.ExceptionResponse/exception
line number         : 5
version             : 1.4.16
-------------------------------

异常发生在客户端上。根据the documentation的说法，我们之所以使用XStream，是因为客户端是通过超文本传输协议连接的，而在这个用例中，客户端需要XStream。

这个应用程序已经在TCP中运行了很长时间，但我们也必须在HTTPS中使用它。自从我们测试HTTPS以来，我们已经遇到了一些由于XStream错误而失败的测试的奇怪行为，但其他HTTPS调用却没有问题。我只是想弄清楚为什么切换到HTTPS会导致这种情况。

Answer 1

在我看来，XStream正在尝试处理来自代理的OpenWire org.apache.activemq.command.ExceptionResponse消息。此消息包含一个序列化的java.io.IOException，而XStream无法转换此消息，因为它需要一个XML有效负载。这就是为什么异常会说：

Caused by: com.thoughtworks.xstream.security.ForbiddenClassException: java.io.IOException

ForbiddenClassException是XStream在响应它无法转换的java.io.IOException时抛出的异常。

首先不清楚是什么触发了java.io.IOException，所以这是值得研究的(例如，查看broker日志)。XStream故障本身似乎是一个错误。但是，我不确定HTTP/S传输的维护是否良好，因此可能不会很快提供错误修复(如果有的话)。您可以尝试从ActiveMQ 5.x迁移(即“经典”)到同样是supports HTTP/S的ActiveMQ Artemis。