Invoking JMETER through java code and running the JMX test file causing Xstream Security Exception

Question

But while doing the same I am getting "Security framework of XStream not initialized, XStream is probably vulnerable." Below is the code snippet

package com.jmeter.runner;

import java.io.FileInputStream;

import org.apache.jmeter.engine.StandardJMeterEngine;
import org.apache.jmeter.save.SaveService;
import org.apache.jmeter.util.JMeterUtils;
import org.apache.jorphan.collections.HashTree;

import com.thoughtworks.xstream.XStream;

public class JMeterFromExistingJMX {

     public static void main(String[] argv) throws Exception {


         Class<?>[] classes = new Class[] { JMeterFromExistingJMX.class };
         XStream xStream = new XStream();
         XStream.setupDefaultSecurity(xStream);
         xStream.allowTypes(classes);   



            // JMeter Engine
            StandardJMeterEngine jmeter = new StandardJMeterEngine();


            // Initialize Properties, logging, locale, etc.
            JMeterUtils.loadJMeterProperties("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/jmeter.properties");
            JMeterUtils.setJMeterHome("F:/Required_Setup_Softwares/apache-jmeter-3.3");
            JMeterUtils.initLogging();// you can comment this line out to see extra log messages of i.e. DEBUG level
            JMeterUtils.initLocale();

            // Initialize JMeter SaveService
            SaveService.loadProperties();

            // Load existing .jmx Test Plan
            FileInputStream in = new FileInputStream("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx");
            HashTree testPlanTree = SaveService.loadTree(in);
            in.close();

            // Run JMeter Test
            jmeter.configure(testPlanTree);
            jmeter.run();
        }   


}

While running I am getting the Xstream security error as below

Security framework of XStream not initialized, XStream is probably vulnerable.
Exception in thread "main" java.lang.NullPointerException
    at org.apache.jmeter.engine.StandardJMeterEngine.configure(StandardJMeterEngine.java:176)
    at com.jmeter.runner.JMeterFromExistingJMX.main(JMeterFromExistingJMX.java:46)

jmeter.configure(testPlanTree); this line causing the issue as internally its using Xstream. So i tried below code to overcome but its not working.

 Class<?>[] classes = new Class[] { JMeterFromExistingJMX.class };
         XStream xStream = new XStream();
         XStream.setupDefaultSecurity(xStream);
         xStream.allowTypes(classes);   

Please help me with the same. I tried the below code as well but its too not working

XStream xstream = new XStream();
// clear out existing permissions and set own ones
xstream.addPermission(NoTypePermission.NONE);
// allow some basics
xstream.addPermission(NullPermission.NULL);
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
xstream.allowTypeHierarchy(Collection.class);
// allow any type from the same package
xstream.allowTypesByWildcard(new String[] {
    "com.your.package.**"
});

Answer 1

I cannot reproduce your issue, however your code looks a little bit flaky:

• Looking into F:/Required_Setup_Softwares/apache-jmeter-3.3 it appears you're using JMeter 3.3
• Looking into SaveService.loadTree() function as per JMeter 3.3 it requires File, not the FileInputStream

So I would recommend the following troubleshooting steps:

1. Make sure you have JMeter 3.3 libraries in your project dependencies

2. Make sure you remove the below code:

   // Load existing .jmx Test Plan
   FileInputStream in = new FileInputStream("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx");
   HashTree testPlanTree = SaveService.loadTree(in);
   in.close();
   

   and substitute it with the following line:

   HashTree testPlanTree = SaveService.loadTree(new File("F:/Required_Setup_Softwares/apache-jmeter-3.3/bin/test.jmx"));
   

3. Perform a clean build of your project - the issue should go away.