From f5a8bdd2c8d5f47aa2793c0e5c43f6b8b1449c79 Mon Sep 17 00:00:00 2001
From: Georgios Andrianakis <geoand@gmail.com>
Date: Mon, 11 Apr 2022 12:54:32 +0300
Subject: [PATCH] Avoid XStream causing illegal access issues for internal JDK
 collections

Relates to: #24492
---
 .../junit/internal/CustomListConverter.java   | 32 +++++++++++++++++++
 .../junit/internal/CustomSetConverter.java    | 32 +++++++++++++++++++
 .../test/junit/internal/XStreamDeepClone.java |  3 +-
 3 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/CustomListConverter.java
 create mode 100644 test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/CustomSetConverter.java

diff --git a/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/CustomListConverter.java b/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/CustomListConverter.java
new file mode 100644
index 00000000000000..1bdce302637487
--- /dev/null
+++ b/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/CustomListConverter.java
@@ -0,0 +1,32 @@
+package io.quarkus.test.junit.internal;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.thoughtworks.xstream.converters.collections.CollectionConverter;
+import com.thoughtworks.xstream.mapper.Mapper;
+
+/**
+ * A custom List converter that always uses ArrayList for unmarshalling.
+ * This is probably not semantically correct 100% of the time, but it's likely fine
+ * for all the cases where we are using marshalling / unmarshalling.
+ *
+ * The reason for doing this is to avoid XStream causing illegal access issues
+ * for internal JDK lists
+ */
+public class CustomListConverter extends CollectionConverter {
+
+    public CustomListConverter(Mapper mapper) {
+        super(mapper);
+    }
+
+    @Override
+    public boolean canConvert(Class type) {
+        return List.class.isAssignableFrom(type);
+    }
+
+    @Override
+    protected Object createCollection(Class type) {
+        return new ArrayList<>();
+    }
+}
diff --git a/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/CustomSetConverter.java b/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/CustomSetConverter.java
new file mode 100644
index 00000000000000..6c63bb733c9ca3
--- /dev/null
+++ b/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/CustomSetConverter.java
@@ -0,0 +1,32 @@
+package io.quarkus.test.junit.internal;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import com.thoughtworks.xstream.converters.collections.CollectionConverter;
+import com.thoughtworks.xstream.mapper.Mapper;
+
+/**
+ * A custom Set converter that always uses HashSet for unmarshalling.
+ * This is probably not semantically correct 100% of the time, but it's likely fine
+ * for all the cases where we are using marshalling / unmarshalling.
+ *
+ * The reason for doing this is to avoid XStream causing illegal access issues
+ * for internal JDK sets
+ */
+public class CustomSetConverter extends CollectionConverter {
+
+    public CustomSetConverter(Mapper mapper) {
+        super(mapper);
+    }
+
+    @Override
+    public boolean canConvert(Class type) {
+        return Set.class.isAssignableFrom(type);
+    }
+
+    @Override
+    protected Object createCollection(Class type) {
+        return new HashSet<>();
+    }
+}
diff --git a/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/XStreamDeepClone.java b/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/XStreamDeepClone.java
index dc945e5bf7f7c4..a200e0a8412659 100644
--- a/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/XStreamDeepClone.java
+++ b/test-framework/junit5/src/main/java/io/quarkus/test/junit/internal/XStreamDeepClone.java
@@ -15,9 +15,10 @@ class XStreamDeepClone implements DeepClone {
         // avoid doing any work eagerly since the cloner is rarely used
         xStreamSupplier = () -> {
             XStream result = new XStream();
-            XStream.setupDefaultSecurity(result);
             result.allowTypesByRegExp(new String[] { ".*" });
             result.setClassLoader(classLoader);
+            result.registerConverter(new CustomListConverter(result.getMapper()));
+            result.registerConverter(new CustomSetConverter(result.getMapper()));
             return result;
         };
     }