debian/changelog

+libpicocontainer1-java (1.3-3) unstable; urgency=medium
+
+  * Team upload.
+  * Switch to debhelper-compat = 13.
+  * Declare compliance with Debian Policy 4.6.0.
+  * Depend on xpp3 artifact instead of xpp3_min.
+  * Extend the xstream whitelist to prevent a ForbiddenClassException.
+    (Closes: #997580)
+
+ -- Markus Koschany <apo@debian.org>  Sat, 13 Nov 2021 18:01:32 +0100
+
 libpicocontainer1-java (1.3-2) unstable; urgency=medium
 
   * No change rebuild.

debian/control

@@ -6,14 +6,14 @@ Uploaders:
  Emmanuel Bourg <ebourg@apache.org>,
  Saif Abdul Cassim <saif.15@cse.mrt.ac.lk>
 Build-Depends:
- debhelper-compat (= 12),
+ debhelper-compat (= 13),
  default-jdk,
  junit,
  libjmock-java,
  libxpp3-java,
  libxstream-java,
  maven-debian-helper
-Standards-Version: 4.4.0
+Standards-Version: 4.6.0
 Vcs-Git: https://salsa.debian.org/java-team/libpicocontainer1-java.git
 Vcs-Browser: https://salsa.debian.org/java-team/libpicocontainer1-java
 Homepage: http://www.picocontainer.org

debian/maven.rules

 junit junit jar s/3\..*/3.x/ * *
 org.picocontainer picocontainer * s/.*/1.x/ * *
+xpp3 s/xpp3_min/xpp3/ * s/.*/debian/ * *

debian/patches/extend-the-xstream-whitelist.patch

+From: Markus Koschany <apo@debian.org>
+Date: Sat, 13 Nov 2021 18:00:25 +0100
+Subject: extend the xstream whitelist
+
+Extend the xstream whitelist.
+
+Forwarded: not-needed
+---
+ .../org/picocontainer/defaults/XStreamSerialisationTestCase.java  | 5 ++++-
+ .../org/picocontainer/doc/advanced/CollectionDemoClasses.java     | 4 ++--
+ .../org/picocontainer/tck/AbstractComponentAdapterTestCase.java   | 8 +++++---
+ 3 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/container/src/test/org/picocontainer/defaults/XStreamSerialisationTestCase.java b/container/src/test/org/picocontainer/defaults/XStreamSerialisationTestCase.java
+index 17eb3a1..d11c102 100644
+--- a/container/src/test/org/picocontainer/defaults/XStreamSerialisationTestCase.java
++++ b/container/src/test/org/picocontainer/defaults/XStreamSerialisationTestCase.java
+@@ -19,6 +19,7 @@ public class XStreamSerialisationTestCase extends TestCase {
+     public void testShouldBeAbleToSerialiseEmptyPico() {
+         if (JVM.is14()) {
+             MutablePicoContainer pico = new DefaultPicoContainer();
++            xStream.allowTypesByWildcard(new String[]{"org.picocontainer.**"});
+             String picoXml = xStream.toXML(pico);
+             PicoContainer serializedPico = (PicoContainer) xStream.fromXML(picoXml);
+ 
+@@ -31,6 +32,7 @@ public class XStreamSerialisationTestCase extends TestCase {
+             MutablePicoContainer pico = new DefaultPicoContainer();
+             pico.registerComponentImplementation(SimpleTouchable.class);
+             pico.registerComponentImplementation(DependsOnTouchable.class);
++            xStream.allowTypesByWildcard(new String[]{"org.picocontainer.**"});
+             String picoXml = xStream.toXML(pico);
+             PicoContainer serializedPico = (PicoContainer) xStream.fromXML(picoXml);
+ 
+@@ -44,10 +46,11 @@ public class XStreamSerialisationTestCase extends TestCase {
+             pico.registerComponentImplementation(SimpleTouchable.class);
+             pico.registerComponentImplementation(DependsOnTouchable.class);
+             pico.getComponentInstances();
++            xStream.allowTypesByWildcard(new String[]{"org.picocontainer.**"});
+             String picoXml = xStream.toXML(pico);
+             PicoContainer serializedPico = (PicoContainer) xStream.fromXML(picoXml);
+ 
+             assertEquals(2, serializedPico.getComponentInstances().size());
+         }
+     }
+-}
+\ No newline at end of file
++}
+diff --git a/container/src/test/org/picocontainer/doc/advanced/CollectionDemoClasses.java b/container/src/test/org/picocontainer/doc/advanced/CollectionDemoClasses.java
+index 0d26e57..86c5deb 100644
+--- a/container/src/test/org/picocontainer/doc/advanced/CollectionDemoClasses.java
++++ b/container/src/test/org/picocontainer/doc/advanced/CollectionDemoClasses.java
+@@ -1,6 +1,6 @@
+ /*
+- * Copyright (C) 2004 Jrg Schaible
+- * Created on 24.10.2004 by Jrg Schaible
++ * Copyright (C) 2004 Joerg Schaible
++ * Created on 24.10.2004 by Joerg Schaible
+  */
+ package org.picocontainer.doc.advanced;
+ 
+diff --git a/container/src/test/org/picocontainer/tck/AbstractComponentAdapterTestCase.java b/container/src/test/org/picocontainer/tck/AbstractComponentAdapterTestCase.java
+index fbaab45..aa3e034 100644
+--- a/container/src/test/org/picocontainer/tck/AbstractComponentAdapterTestCase.java
++++ b/container/src/test/org/picocontainer/tck/AbstractComponentAdapterTestCase.java
+@@ -235,7 +235,8 @@ public abstract class AbstractComponentAdapterTestCase extends MockObjectTestCas
+             assertSame(getComponentAdapterType(), componentAdapter.getClass());
+             final Object instance = componentAdapter.getComponentInstance(picoContainer);
+             assertNotNull(instance);
+-            final XStream xstream = new XStream(new PureJavaReflectionProvider(), new XppDriver());
++            XStream xstream = new XStream(new PureJavaReflectionProvider(), new XppDriver());
++            xstream.allowTypesByWildcard(new String[]{"org.picocontainer.**"});
+             final String xml = xstream.toXML(componentAdapter);
+             final ComponentAdapter serializedComponentAdapter = (ComponentAdapter)xstream.fromXML(xml);
+             assertEquals(componentAdapter.getComponentKey(), serializedComponentAdapter.getComponentKey());
+@@ -252,7 +253,8 @@ public abstract class AbstractComponentAdapterTestCase extends MockObjectTestCas
+             assertSame(getComponentAdapterType(), componentAdapter.getClass());
+             final Object instance = componentAdapter.getComponentInstance(picoContainer);
+             assertNotNull(instance);
+-            final XStream xstream = new XStream(new XppDriver());
++            XStream xstream = new XStream(new XppDriver());
++            xstream.allowTypesByWildcard(new String[]{"org.picocontainer.**"});
+             final String xml = xstream.toXML(componentAdapter);
+             final ComponentAdapter serializedComponentAdapter = (ComponentAdapter)xstream.fromXML(xml);
+             assertEquals(componentAdapter.getComponentKey(), serializedComponentAdapter.getComponentKey());
+@@ -649,4 +651,4 @@ public abstract class AbstractComponentAdapterTestCase extends MockObjectTestCas
+         }
+         return hasParameters;
+     }
+-}
+\ No newline at end of file
++}

debian/patches/series

+extend-the-xstream-whitelist.patch