通过Java代码调用Jmeter并运行JMX测试文件，从而导致Xstream Security例外

Question

，但是尽管这样做相同，但我得到的是" Xstream的安全框架未初始化，Xstream可能很脆弱"。以下是代码片段

package com.jmeter.runner;
import java.io.FileInputStream;
import org.apache.jmeter.engine.StandardJMeterEngine;
import org.apache.jmeter.save.SaveService;
import org.apache.jmeter.util.JMeterUtils;
import org.apache.jorphan.collections.HashTree;
import com.thoughtworks.xstream.XStream;
public class JMeterFromExistingJMX {
     public static void main(String[] argv) throws Exception {

         Class<?>[] classes = new Class[] { JMeterFromExistingJMX.class };
         XStream xStream = new XStream();
         XStream.setupDefaultSecurity(xStream);
         xStream.allowTypes(classes);   

            // JMeter Engine
            StandardJMeterEngine jmeter = new StandardJMeterEngine();

            // Initialize Properties, logging, locale, etc.
            JMeterUtils.loadJMeterProperties("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/jmeter.properties");
            JMeterUtils.setJMeterHome("F:/Required_Setup_Softwares/apache-jmeter-3.3");
            JMeterUtils.initLogging();// you can comment this line out to see extra log messages of i.e. DEBUG level
            JMeterUtils.initLocale();
            // Initialize JMeter SaveService
            SaveService.loadProperties();
            // Load existing .jmx Test Plan
            FileInputStream in = new FileInputStream("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx");
            HashTree testPlanTree = SaveService.loadTree(in);
            in.close();
            // Run JMeter Test
            jmeter.configure(testPlanTree);
            jmeter.run();
        }   

}

在运行时，我将获得Xstream安全错误，如下

Security framework of XStream not initialized, XStream is probably vulnerable.
Exception in thread "main" java.lang.NullPointerException
    at org.apache.jmeter.engine.StandardJMeterEngine.configure(StandardJMeterEngine.java:176)
    at com.jmeter.runner.JMeterFromExistingJMX.main(JMeterFromExistingJMX.java:46)

jmeter.configure（testplantree）;这条线导致该问题在内部使用Xstream。因此，我尝试了以下代码来克服，但它不起作用。

 Class<?>[] classes = new Class[] { JMeterFromExistingJMX.class };
         XStream xStream = new XStream();
         XStream.setupDefaultSecurity(xStream);
         xStream.allowTypes(classes);   

请帮助我。我也尝试了以下代码，但它也无法正常工作

XStream xstream = new XStream();
// clear out existing permissions and set own ones
xstream.addPermission(NoTypePermission.NONE);
// allow some basics
xstream.addPermission(NullPermission.NULL);
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
xstream.allowTypeHierarchy(Collection.class);
// allow any type from the same package
xstream.allowTypesByWildcard(new String[] {
    "com.your.package.**"
});

Answer 1

我无法复制您的问题，但是您的代码看起来有些片状：

• 研究F:/Required_Setup_Softwares/apache-jmeter-3.3似乎您正在使用Jmeter 3.3
• 根据jmeter 3.3查看saveservice.loadtree（）函数，而不是fileinputstream

所以我建议以下故障排除步骤：

1. 确保您的项目依赖项中有jmeter 3.3库

2. 确保删除以下代码：

   // Load existing .jmx Test Plan
   FileInputStream in = new FileInputStream("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx");
   HashTree testPlanTree = SaveService.loadTree(in);
   in.close();
   

   并用以下行替换：

   HashTree testPlanTree = SaveService.loadTree(new File("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx"));
   

3. 执行您项目的干净构建 - 问题应该消失。