Addresses Issue #3288 by providing :

- a new version of XStream library (1.4.18)
- a static initialization of the data streamer (should be thread safe)
- a "whitelisting" of all classes to avoir security errors

Please test more thoroughly...

ummisco.gama.serialize/.classpath

@@ -1,11 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <classpath>
+	<classpathentry exported="true" kind="lib" path="ext/mxparser-1.2.2.jar"/>
+	<classpathentry exported="true" kind="lib" path="ext/xstream-1.4.18.jar"/>
 	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/>
 	<classpathentry kind="con" path="org.eclipse.pde.core.requiredPlugins"/>
 	<classpathentry kind="src" path="src"/>
-	<classpathentry exported="true" kind="lib" path="ext/xstream-1.4.8.jar"/>
-	<classpathentry exported="true" kind="lib" path="ext/kxml2-2.3.0.jar"/>
-	<classpathentry exported="true" kind="lib" path="ext/xmlpull-1.1.3.1.jar"/>
 	<classpathentry kind="src" path="gaml">
 		<attributes>
 			<attribute name="optional" value="true"/>

ummisco.gama.serialize/META-INF/MANIFEST.MF

@@ -7,9 +7,8 @@ Require-Bundle: msi.gama.core,
  msi.gama.ext,
  msi.gaml.architecture.simplebdi;bundle-version="1.8.2"
 Bundle-ClassPath: .,
- ext/xstream-1.4.8.jar,
- ext/kxml2-2.3.0.jar,
- ext/xmlpull-1.1.3.1.jar
+ ext/mxparser-1.2.2.jar,
+ ext/xstream-1.4.18.jar
 Export-Package: com.thoughtworks.xstream,
  com.thoughtworks.xstream.annotations,
  com.thoughtworks.xstream.converters,

ummisco.gama.serialize/build.properties

@@ -4,7 +4,6 @@ output.. = bin/
 bin.includes = META-INF/,\
                .,\
                plugin.xml,\
-               ext/,\
-               ext/kxml2-2.3.0.jar,\
-               ext/xmlpull-1.1.3.1.jar,\
-               models/
+               models/,\
+               ext/mxparser-1.2.2.jar,\
+               ext/xstream-1.4.18.jar

ummisco.gama.serialize/src/ummisco/gama/serializer/factory/StreamConverter.java

@@ -1,82 +1,180 @@
-/*********************************************************************************************
+/*******************************************************************************************************
  *
- * 'StreamConverter.java, in plugin ummisco.gama.serialize, is part of the source code of the GAMA modeling and
- * simulation platform. (v. 1.8.1)
+ * StreamConverter.java, in ummisco.gama.serialize, is part of the source code of the GAMA modeling and simulation
+ * platform (v.1.8.2).
  *
- * (c) 2007-2020 UMI 209 UMMISCO IRD/UPMC & Partners
+ * (c) 2007-2022 UMI 209 UMMISCO IRD/SU & Partners (IRIT, MIAT, TLU, CTU)
  *
- * Visit https://github.com/gama-platform/gama for license information and developers contact.
+ * Visit https://github.com/gama-platform/gama for license information and contacts.
  *
- *
- **********************************************************************************************/
+ ********************************************************************************************************/
 package ummisco.gama.serializer.factory;
 
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.converters.Converter;
 import com.thoughtworks.xstream.io.xml.DomDriver;
+import com.thoughtworks.xstream.security.AnyTypePermission;
 
 import msi.gama.runtime.IScope;
 import msi.gaml.compilation.kernel.GamaClassLoader;
 import ummisco.gama.serializer.gamaType.converters.ConverterScope;
 
+/**
+ * The Class StreamConverter.
+ */
 public abstract class StreamConverter {
 
-	public static void registerConverter(final XStream dataStreamer, final Converter c) {
-		dataStreamer.registerConverter(c);
+	/** The streamer. */
+	static XStream streamer;
+
+	static {
+		streamer = new XStream(new DomDriver());
+		streamer.addPermission(AnyTypePermission.ANY);
+		streamer.setClassLoader(GamaClassLoader.getInstance());
+	}
+
+	/**
+	 * Register converter.
+	 *
+	 * @param dataStreamer
+	 *            the data streamer
+	 * @param c
+	 *            the c
+	 */
+	public static void registerConverter(final Converter c) {
+		streamer.registerConverter(c);
 	}
 
+	/**
+	 * Load and build.
+	 *
+	 * @param cs
+	 *            the cs
+	 * @return the x stream
+	 */
 	public static XStream loadAndBuild(final ConverterScope cs) {
-		final XStream dataStreamer = new XStream(new DomDriver());
-		dataStreamer.setClassLoader(GamaClassLoader.getInstance());
 
 		final Converter[] cnv = Converters.converterFactory(cs);
-		for (final Converter c : cnv) {
-			StreamConverter.registerConverter(dataStreamer, c);
-		}
+		for (final Converter c : cnv) { StreamConverter.registerConverter(c); }
 		// dataStreamer.setMode(XStream.ID_REFERENCES);
-		return dataStreamer;
+		return streamer;
 	}
 
+	/**
+	 * Convert object to stream.
+	 *
+	 * @param scope
+	 *            the scope
+	 * @param o
+	 *            the o
+	 * @return the string
+	 */
 	public static synchronized String convertObjectToStream(final IScope scope, final Object o) {
 		return loadAndBuild(new ConverterScope(scope)).toXML(o);
 	}
 
+	/**
+	 * Convert object to stream.
+	 *
+	 * @param scope
+	 *            the scope
+	 * @param o
+	 *            the o
+	 * @return the string
+	 */
 	public static synchronized String convertObjectToStream(final ConverterScope scope, final Object o) {
 		return loadAndBuild(scope).toXML(o);
 	}
 
+	/**
+	 * Convert stream to object.
+	 *
+	 * @param scope
+	 *            the scope
+	 * @param data
+	 *            the data
+	 * @return the object
+	 */
 	public static Object convertStreamToObject(final IScope scope, final String data) {
 		return loadAndBuild(new ConverterScope(scope)).fromXML(data);
 	}
 
+	/**
+	 * Convert stream to object.
+	 *
+	 * @param scope
+	 *            the scope
+	 * @param data
+	 *            the data
+	 * @return the object
+	 */
 	public static Object convertStreamToObject(final ConverterScope scope, final String data) {
 		return loadAndBuild(scope).fromXML(data);
 	}
 
+	/**
+	 * Load and build network.
+	 *
+	 * @param cs
+	 *            the cs
+	 * @return the x stream
+	 */
 	// TODO To remove when possible
 	public static XStream loadAndBuildNetwork(final ConverterScope cs) {
-		final XStream dataStreamer = new XStream(new DomDriver());
-		dataStreamer.setClassLoader(GamaClassLoader.getInstance());
 
 		final Converter[] cnv = Converters.converterNetworkFactory(cs);
-		for (final Converter c : cnv) {
-			StreamConverter.registerConverter(dataStreamer, c);
-		}
-		return dataStreamer;
+		for (final Converter c : cnv) { StreamConverter.registerConverter(c); }
+		return streamer;
 	}
 
+	/**
+	 * Convert network object to stream.
+	 *
+	 * @param scope
+	 *            the scope
+	 * @param o
+	 *            the o
+	 * @return the string
+	 */
 	public static synchronized String convertNetworkObjectToStream(final ConverterScope scope, final Object o) {
 		return loadAndBuildNetwork(scope).toXML(o);
 	}
 
+	/**
+	 * Convert network object to stream.
+	 *
+	 * @param scope
+	 *            the scope
+	 * @param o
+	 *            the o
+	 * @return the string
+	 */
 	public static synchronized String convertNetworkObjectToStream(final IScope scope, final Object o) {
 		return loadAndBuildNetwork(new ConverterScope(scope)).toXML(o);
 	}
 
+	/**
+	 * Convert network stream to object.
+	 *
+	 * @param scope
+	 *            the scope
+	 * @param data
+	 *            the data
+	 * @return the object
+	 */
 	public static Object convertNetworkStreamToObject(final ConverterScope scope, final String data) {
 		return loadAndBuildNetwork(scope).fromXML(data);
 	}
 
+	/**
+	 * Convert network stream to object.
+	 *
+	 * @param scope
+	 *            the scope
+	 * @param data
+	 *            the data
+	 * @return the object
+	 */
 	public static Object convertNetworkStreamToObject(final IScope scope, final String data) {
 		return loadAndBuildNetwork(new ConverterScope(scope)).fromXML(data);
 	}