Vulnerable Components lesson 12 broken due to too new dependency #725
Description
Lesson doesnt work, like suggested in the wiki guide.
When ran in debug mode, this seems to be because of an exception that gives:
Exception in thread "main" com.thoughtworks.xstream.converters.ConversionException: No converter specified for class java.beans.EventHandler
When researching, this is because from version 1.4.7 this vulnerability was fixed in xstream. When manually changing to version 1.4.5 in Maven, a known vulnerable version, this lesson works as intended again. Also in Maven, the 1.4.7 version is commented with:
So I guess this was left in after some debugging efforts or something? Or maybe 1.4.7 was the latest version back when this lesson was created, and it recently may have gotten fixed. It completely nullifies the point of the lesson however.