any type permission for clone

Author: michi42

src/java/cern/accsoft/steering/jmad/modeldefs/io/impl/AbstractModelDefinitionPersistenceService.java

@@ -23,7 +23,6 @@
 import cern.accsoft.steering.jmad.util.xml.PersistenceService;
 import cern.accsoft.steering.jmad.util.xml.PersistenceServiceException;
 import com.thoughtworks.xstream.XStream;
-import com.thoughtworks.xstream.security.AnyTypePermission;
 
 public abstract class AbstractModelDefinitionPersistenceService implements ModelDefinitionPersistenceService {
 	@Override
@@ -95,7 +94,5 @@ protected final void configureXStream(XStream xStream) {
 
 		/* The default implementations */
 		xStream.addDefaultImplementation(ModelPathOffsetsImpl.class, ModelPathOffsets.class);
-
-		xStream.addPermission(AnyTypePermission.ANY);
 	}
 }

src/java/cern/accsoft/steering/jmad/util/xml/AbstractXStreamService.java

@@ -17,8 +17,8 @@ public abstract class AbstractXStreamService<T> extends GenericXStreamService<T>
     @Override
     protected XStream createXStream() {
         this.xStream = this.newXStreamInstance();
-        this.xStream.addPermission(AnyTypePermission.ANY);
         this.initializeXStream(this.xStream);
+        this.xStream.addPermission(AnyTypePermission.ANY);
         return this.xStream;
     }
 

src/java/cern/accsoft/steering/jmad/util/xml/CloneUtil.java

@@ -27,6 +27,7 @@
 
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.converters.Converter;
+import com.thoughtworks.xstream.security.AnyTypePermission;
 
 /**
  * This is a utility class that uses the XStream mechanism to clone objects. Custom converters can be provided in order
@@ -45,6 +46,7 @@ public static <T> T clone(Class<T> clazz, T object) {
         XStream xStream = new XStream();
         xStream.autodetectAnnotations(true);
         xStream.processAnnotations(clazz);
+        xStream.addPermission(AnyTypePermission.ANY);
         return (T) xStream.fromXML(xStream.toXML(object));
     }
 
@@ -54,6 +56,7 @@ public static <T> T clone(Class<T> clazz, T object, Converter converter) {
         xStream.registerConverter(converter);
         xStream.autodetectAnnotations(true);
         xStream.processAnnotations(clazz);
+        xStream.addPermission(AnyTypePermission.ANY);
         return (T) xStream.fromXML(xStream.toXML(object));
 
     }