安全使用xstream fromXML

xstream_fromXML_poc.java

public static <T> T readValue(String content, Class<T> valueType) {
    XStream xstream = new XStream();
    
    // clean rules
    xstream.addPermission(NoTypePermission.None);
    
    // only allow Target class type
    xstream.allowTypeHierarchy(valueType.class);
    
    return (T) xstream.fromXML(content);
}