Skip to content

Vulnerable Components lesson 12 broken due to too new dependency #725

Closed
@thegoodcrumpets

Description

Lesson doesnt work, like suggested in the wiki guide.
When ran in debug mode, this seems to be because of an exception that gives:
Exception in thread "main" com.thoughtworks.xstream.converters.ConversionException: No converter specified for class java.beans.EventHandler

When researching, this is because from version 1.4.7 this vulnerability was fixed in xstream. When manually changing to version 1.4.5 in Maven, a known vulnerable version, this lesson works as intended again. Also in Maven, the 1.4.7 version is commented with:

So I guess this was left in after some debugging efforts or something? Or maybe 1.4.7 was the latest version back when this lesson was created, and it recently may have gotten fixed. It completely nullifies the point of the lesson however.

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions