Merge branch 'master' of git.cardforge.org:core-developers/forge

forge-gui-desktop/src/main/java/forge/control/FControl.java

@@ -234,6 +234,7 @@ public enum FControl implements KeyEventDispatcher {
             try {
                 FModel.getQuest().load(QuestDataIO.loadData(data));
             } catch(IOException ex) {
+                ex.printStackTrace();
                 System.out.println(String.format("Error loading quest data (%s).. skipping for now..", questname));
             }
         }

forge-gui-desktop/src/main/java/forge/screens/home/gauntlet/CSubmenuGauntletContests.java

@@ -67,10 +67,12 @@ public enum CSubmenuGauntletContests implements ICDoc {
     private void updateData() {
         final File[] files = GauntletIO.getGauntletFilesLocked();
         final List<GauntletData> data = new ArrayList<GauntletData>();
-        for (final File f : files) {
-            final GauntletData gd = GauntletIO.loadGauntlet(f);
-            if (gd != null) {
-                data.add(gd);
+        if (files != null) {
+            for (final File f : files) {
+                final GauntletData gd = GauntletIO.loadGauntlet(f);
+                if (gd != null) {
+                    data.add(gd);
+                }
             }
         }
 

forge-gui-desktop/src/main/java/forge/screens/home/quest/CSubmenuQuestData.java

@@ -184,6 +184,7 @@ public enum CSubmenuQuestData implements ICDoc {
                 System.out.println(String.format("About to load quest (%s)... ", f.getName()));
                 arrQuests.put(f.getName(), QuestDataIO.loadData(f));
             } catch(IOException ex) {
+                ex.printStackTrace();
                 System.out.println(String.format("Error loading quest data (%s).. skipping for now..", f.getName()));
                 restorableQuests.add(f.getName());
             }

forge-gui/src/main/java/forge/gauntlet/GauntletIO.java

@@ -7,10 +7,22 @@ import java.io.FileOutputStream;
 import java.io.FilenameFilter;
 import java.io.IOException;
 import java.io.InputStreamReader;
+import java.util.ArrayList;
+import java.util.EnumMap;
+import java.util.List;
 import java.util.Map.Entry;
+import java.util.SortedSet;
+import java.util.TreeMap;
 import java.util.zip.GZIPInputStream;
 import java.util.zip.GZIPOutputStream;
 
+import com.thoughtworks.xstream.converters.ConversionException;
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
+import forge.deck.Deck;
+import forge.deck.DeckSection;
+import forge.error.BugReporter;
 import org.apache.commons.lang3.StringUtils;
 
 import com.thoughtworks.xstream.XStream;
@@ -40,6 +52,25 @@ public class GauntletIO {
 
     protected static XStream getSerializer(final boolean isIgnoring) {
         final XStream xStream = isIgnoring ? new IgnoringXStream() : new XStream();
+        // clear out existing permissions and set our own
+        xStream.addPermission(NoTypePermission.NONE);
+        // allow some basics
+        xStream.addPermission(NullPermission.NULL);
+        xStream.addPermission(PrimitiveTypePermission.PRIMITIVES);
+        xStream.allowTypeHierarchy(String.class);
+        xStream.allowTypeHierarchy(EnumMap.class);
+        xStream.allowTypeHierarchy(ArrayList.class);
+        xStream.allowTypeHierarchy(CardPool.class);
+        xStream.allowTypeHierarchy(SortedSet.class);
+        xStream.allowTypeHierarchy(Deck.class);
+        xStream.allowTypeHierarchy(TreeMap.class);
+        xStream.allowTypeHierarchy(List.class);
+        xStream.allowTypeHierarchy(DeckSection.class);
+        // allow any type from the same package
+        xStream.allowTypesByWildcard(new String[] {
+                GauntletIO.class.getPackage().getName()+".*",
+                String.class.getPackage().getName()+".*"
+        });
         xStream.registerConverter(new DeckSectionToXml());
         xStream.autodetectAnnotations(true);
         return xStream;
@@ -93,6 +124,9 @@ public class GauntletIO {
         catch (final IOException e) {
             e.printStackTrace();
         }
+        catch (final ConversionException e) {
+            BugReporter.reportException(e);
+        }
         catch (final Exception e) { //if there's a non-IO exception, delete the corrupt file
             e.printStackTrace();
             isCorrupt = true;

forge-gui/src/main/java/forge/quest/bazaar/QuestBazaarManager.java

@@ -32,6 +32,9 @@ import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
 import org.w3c.dom.Attr;
 import org.w3c.dom.Document;
 import org.w3c.dom.NamedNodeMap;
@@ -69,6 +72,16 @@ public class QuestBazaarManager {
             final Document document = builder.parse(xmlFile);
 
             final XStream xs = new IgnoringXStream();
+            // clear out existing permissions and set our own
+            xs.addPermission(NoTypePermission.NONE);
+            // allow some basics
+            xs.addPermission(NullPermission.NULL);
+            xs.addPermission(PrimitiveTypePermission.PRIMITIVES);
+            xs.allowTypeHierarchy(String.class);
+            // allow any type from the same package
+            xs.allowTypesByWildcard(new String[] {
+                    QuestBazaarManager.class.getPackage().getName()+".*"
+            });
             xs.autodetectAnnotations(true);
 
             final NodeList xmlStalls = document.getElementsByTagName("stalls").item(0).getChildNodes();

forge-gui/src/main/java/forge/quest/bazaar/QuestPetStorage.java

 package forge.quest.bazaar;
 
 import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
 import forge.quest.data.QuestAssets;
 import forge.util.IgnoringXStream;
 import forge.util.XmlUtil;
@@ -42,6 +45,17 @@ public class QuestPetStorage {
             final Document document = builder.parse(file);
 
             final XStream xs = new IgnoringXStream();
+            // clear out existing permissions and set our own
+            xs.addPermission(NoTypePermission.NONE);
+            // allow some basics
+            xs.addPermission(NullPermission.NULL);
+            xs.addPermission(PrimitiveTypePermission.PRIMITIVES);
+            xs.allowTypeHierarchy(String.class);
+            // allow any type from the same package
+            xs.allowTypesByWildcard(new String[] {
+                    QuestPetStorage.class.getPackage().getName()+".*"
+            });
+
             xs.autodetectAnnotations(true);
 
             final NodeList xmlPets = document.getElementsByTagName("pets").item(0).getChildNodes();

forge-gui/src/main/java/forge/quest/io/QuestDataIO.java

@@ -17,6 +17,9 @@
  */
 package forge.quest.io;
 
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
 import forge.quest.data.QuestPreferences.QPref;
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.converters.Converter;
@@ -78,6 +81,23 @@ public class QuestDataIO {
      */
     protected static XStream getSerializer(final boolean isIgnoring) {
         final XStream xStream = isIgnoring ? new IgnoringXStream() : new XStream();
+        // clear out existing permissions and set our own
+        xStream.addPermission(NoTypePermission.NONE);
+        // allow some basics
+        xStream.addPermission(NullPermission.NULL);
+        xStream.addPermission(PrimitiveTypePermission.PRIMITIVES);
+        xStream.allowTypeHierarchy(String.class);
+        xStream.allowTypeHierarchy(QuestData.class);
+        xStream.allowTypeHierarchy(HashMap.class);
+        xStream.allowTypeHierarchy(Deck.class);
+        xStream.allowTypeHierarchy(DeckGroup.class);
+        xStream.allowTypeHierarchy(EnumMap.class);
+        xStream.allowTypeHierarchy(QuestItemType.class);
+        // allow any type from the same package
+        xStream.allowTypesByWildcard(new String[] {
+                QuestDataIO.class.getPackage().getName()+".*",
+                "forge.quest.data.*"
+        });
         xStream.registerConverter(new ItemPoolToXml());
         xStream.registerConverter(new DeckToXml());
         xStream.registerConverter(new DraftTournamentToXml());

forge-gui/src/main/java/forge/tournament/TournamentIO.java

@@ -6,6 +6,9 @@ import com.thoughtworks.xstream.converters.MarshallingContext;
 import com.thoughtworks.xstream.converters.UnmarshallingContext;
 import com.thoughtworks.xstream.io.HierarchicalStreamReader;
 import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
 import forge.deck.CardPool;
 import forge.item.PaperCard;
 import forge.model.FModel;
@@ -32,6 +35,16 @@ public class TournamentIO {
 
     protected static XStream getSerializer(final boolean isIgnoring) {
         final XStream xStream = isIgnoring ? new IgnoringXStream() : new XStream();
+        // clear out existing permissions and set our own
+        xStream.addPermission(NoTypePermission.NONE);
+        // allow some basics
+        xStream.addPermission(NullPermission.NULL);
+        xStream.addPermission(PrimitiveTypePermission.PRIMITIVES);
+        xStream.allowTypeHierarchy(String.class);
+        // allow any type from the same package
+        xStream.allowTypesByWildcard(new String[] {
+                TournamentIO.class.getPackage().getName()+".*"
+        });
         xStream.registerConverter(new DeckSectionToXml());
         xStream.autodetectAnnotations(true);
         return xStream;