Question

但在做同样的事情时，我得到的“XStream的安全框架未初始化，XStream可能很容易受到攻击。”以下是代码段

package com.jmeter.runner;

import java.io.FileInputStream;

import org.apache.jmeter.engine.StandardJMeterEngine;
import org.apache.jmeter.save.SaveService;
import org.apache.jmeter.util.JMeterUtils;
import org.apache.jorphan.collections.HashTree;

import com.thoughtworks.xstream.XStream;

public class JMeterFromExistingJMX {

     public static void main(String[] argv) throws Exception {


         Class<?>[] classes = new Class[] { JMeterFromExistingJMX.class };
         XStream xStream = new XStream();
         XStream.setupDefaultSecurity(xStream);
         xStream.allowTypes(classes);   



            // JMeter Engine
            StandardJMeterEngine jmeter = new StandardJMeterEngine();


            // Initialize Properties, logging, locale, etc.
            JMeterUtils.loadJMeterProperties("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/jmeter.properties");
            JMeterUtils.setJMeterHome("F:/Required_Setup_Softwares/apache-jmeter-3.3");
            JMeterUtils.initLogging();// you can comment this line out to see extra log messages of i.e. DEBUG level
            JMeterUtils.initLocale();

            // Initialize JMeter SaveService
            SaveService.loadProperties();

            // Load existing .jmx Test Plan
            FileInputStream in = new FileInputStream("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx");
            HashTree testPlanTree = SaveService.loadTree(in);
            in.close();

            // Run JMeter Test
            jmeter.configure(testPlanTree);
            jmeter.run();
        }   


}

在运行时，我收到Xstream安全错误，如下所示

Security framework of XStream not initialized, XStream is probably vulnerable.
Exception in thread "main" java.lang.NullPointerException
    at org.apache.jmeter.engine.StandardJMeterEngine.configure(StandardJMeterEngine.java:176)
    at com.jmeter.runner.JMeterFromExistingJMX.main(JMeterFromExistingJMX.java:46)

jmeter.configure（testPlanTree）;这一行导致问题在内部使用Xstream。所以我尝试下面的代码来克服，但它不起作用。

 Class<?>[] classes = new Class[] { JMeterFromExistingJMX.class };
         XStream xStream = new XStream();
         XStream.setupDefaultSecurity(xStream);
         xStream.allowTypes(classes);

请帮我一样。我也尝试了以下代码，但它也无法正常工作

XStream xstream = new XStream();
// clear out existing permissions and set own ones
xstream.addPermission(NoTypePermission.NONE);
// allow some basics
xstream.addPermission(NullPermission.NULL);
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
xstream.allowTypeHierarchy(Collection.class);
// allow any type from the same package
xstream.allowTypesByWildcard(new String[] {
    "com.your.package.**"
});

Answer 1

我无法重现您的问题，但您的代码看起来有点不稳定：

查看F:/Required_Setup_Softwares/apache-jmeter-3.3，您似乎正在使用JMeter 3.3
根据JMeter 3.3查看SaveService.loadTree()函数需要File，而不是FileInputStream

因此，我建议采取以下问题排查步骤：

确保您的项目依赖项中有JMeter 3.3 libraries

请务必删除以下代码：

// Load existing .jmx Test Plan
FileInputStream in = new FileInputStream("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx");
HashTree testPlanTree = SaveService.loadTree(in);
in.close();

并将其替换为以下行：

HashTree testPlanTree = SaveService.loadTree(new File("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx"));

执行项目的干净构建 - 问题应该消失。

通过Java代码调用JMETER并运行导致Xstream Security Exception的JMX测试文件

1 个答案: