Closed raphael-jungers closed 3 years ago
Thanks for providing the description here, @raphael-jungers.
I have already made the required adjustment in the MongoSagaStore
.
In issue #133, to be exact.
The fact it isn't released yet is because other assignments are blocking the release right now.
The workaround to add a dedicated XStream
instance, which you describe, is the recommended approach.
I would highly recommend anybody to provide a dedicated XStream
instance if they're using the XStreamSerializer
.
Severals CVE's have come out for XStream that warrant this shift.
Concluding, the issue has already been resolved. As such, I will close this issue as a duplicate. Feel free to keep commenting if that's applicable.
Basic information
Steps to reproduce
Using Spring Boot, declare a SagaStore Bean :
Expected behaviour
The application should start and Axon should use the provided Bean as SagaStore.
Actual behaviour
The application fails to start. I tracked the Exception and its cause.
I think the issue is with this line, which indeed does not provide a XStream instance to the XStreamSerializer builder.
Line 159 of MongoSagaStore.java file :
private Serializer serializer = XStreamSerializer.builder().build();
I guess it could be solved easily by replacing this line by :
private Serializer serializer = XStreamSerializer.builder().xStream(new XStream()).build();
I can help with a pull request if that is solving the issue.
Thank you
Full stacktrace