[SECURITY-49] dependency changes needed for the fix.

(On trunk these commits are done separately as
72c68a2
45b8f82
31d2e03

core/src/main/java/jenkins/util/io/FileBoolean.java

@@ -0,0 +1,61 @@
+package jenkins.util.io;
+
+import jenkins.model.Jenkins;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+/**
+ * Uses a presence/absence of a file as a persisted boolean storage.
+ *
+ * <p>
+ * This is convenient when you need to store just a few bits of infrequently accessed information
+ * as you can forget the explicit persistence of it. This class masks I/O problem, so if the persistence
+ * fails, you'll get no error report.
+ *
+ * @author Kohsuke Kawaguchi
+ * @since 1.498
+ */
+public class FileBoolean {
+    private final File file;
+
+    public FileBoolean(File file) {
+        this.file = file;
+    }
+
+    public FileBoolean(Class owner, String name) {
+        this(new File(Jenkins.getInstance().getRootDir(),owner.getName().replace('$','.')+'/'+name));
+    }
+
+    /**
+     * Gets the current state. True if the file exists, false if it doesn't.
+     */
+    public boolean get() {
+        return file.exists();
+    }
+
+    public boolean isOn() { return get(); }
+    public boolean isOff() { return !get(); }
+
+    public void set(boolean b) {
+        if (b) on(); else off();
+    }
+
+    public void on() {
+        try {
+            file.getParentFile().mkdirs();
+            new FileOutputStream(file).close();
+        } catch (IOException e) {
+            LOGGER.log(Level.WARNING, "Failed to touch "+file);
+        }
+    }
+
+    public void off() {
+        file.delete();
+    }
+
+    private static final Logger LOGGER = Logger.getLogger(FileBoolean.class.getName());
+}

core/src/main/java/jenkins/util/xstream/XStreamDOM.java

@@ -35,10 +35,21 @@
 import com.thoughtworks.xstream.io.xml.AbstractXmlWriter;
 import com.thoughtworks.xstream.io.xml.DocumentReader;
 import com.thoughtworks.xstream.io.xml.XmlFriendlyReplacer;
+import com.thoughtworks.xstream.io.xml.XppDriver;
 import hudson.Util;
 import hudson.util.VariableResolver;
 
+import hudson.util.XStream2;
+import org.apache.commons.io.IOUtils;
+
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.Reader;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.io.Writer;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
@@ -61,6 +72,16 @@
  * The reverse operation is {@link #from(XStream, Object)} method, which marshals an object
  * into {@link XStreamDOM}.
  *
+ * <p>
+ * You can also use this class to parse an entire XML document into a DOM like tree with
+ * {@link #from(HierarchicalStreamReader)} and {@link #writeTo(HierarchicalStreamWriter)}.
+ * These two methods support variants that accept other forms.
+ * <p>
+ * Whereas the above methods read from and write to {@link HierarchicalStreamReader} and,
+ * {@link HierarchicalStreamWriter}, we can also create {@link HierarchicalStreamReader}
+ * that read from DOM and {@link HierarchicalStreamWriter} that writes to DOM. See
+ * {@link #newReader()} and {@link #newWriter()} for those operations.
+ *
  * @author Kohsuke Kawaguchi
  * @since 1.473
  */
@@ -184,6 +205,21 @@ public static WriterImpl newWriter() {
         return new WriterImpl();
     }
 
+    /**
+     * Writes this {@link XStreamDOM} into {@link OutputStream}.
+     */
+    public void writeTo(OutputStream os) {
+        writeTo(new XppDriver().createWriter(os));
+    }
+
+    public void writeTo(Writer w) {
+        writeTo(new XppDriver().createWriter(w));
+    }
+
+    public void writeTo(HierarchicalStreamWriter w) {
+        new ConverterImpl().marshal(this,w,null);
+    }
+
     /**
      * Marshals the given object with the given XStream into {@link XStreamDOM} and return it.
      */
@@ -193,6 +229,25 @@ public static XStreamDOM from(XStream xs, Object obj) {
         return w.getOutput();
     }
 
+    public static XStreamDOM from(InputStream in) {
+        return from(new XppDriver().createReader(in));
+    }
+
+    public static XStreamDOM from(Reader in) {
+        return from(new XppDriver().createReader(in));
+    }
+
+    public static XStreamDOM from(HierarchicalStreamReader in) {
+        return new ConverterImpl().unmarshalElement(in, null);
+    }
+
+    public Map<String, String> getAttributeMap() {
+        Map<String,String> r = new HashMap<String, String>();
+        for (int i=0; i<attributes.length; i+=2)
+            r.put(attributes[i],attributes[i+1]);
+        return r;
+    }
+
     private static class ReaderImpl extends AbstractXmlReader implements DocumentReader {
         private static class Pointer {
             final XStreamDOM node;
@@ -396,9 +451,17 @@ public void marshal(Object source, HierarchicalStreamWriter w, MarshallingContex
             w.endNode();
         }
 
+        /**
+         * Unmarshals a single child element.
+         */
         public XStreamDOM unmarshal(HierarchicalStreamReader r, UnmarshallingContext context) {
             r.moveDown();
+            XStreamDOM dom = unmarshalElement(r,context);
+            r.moveUp();
+            return dom;
+        }
 
+        public XStreamDOM unmarshalElement(HierarchicalStreamReader r, UnmarshallingContext context) {
             String name = r.getNodeName();
 
             int c = r.getAttributeCount();
@@ -418,7 +481,6 @@ public XStreamDOM unmarshal(HierarchicalStreamReader r, UnmarshallingContext con
             } else {
                 value = r.getValue();
             }
-            r.moveUp();
 
             return new XStreamDOM(name,attributes,children,value);
         }

core/src/test/java/jenkins/util/xstream/XStreamDOMTest.java

@@ -23,14 +23,19 @@
  */
 package jenkins.util.xstream;
 
+import com.thoughtworks.xstream.io.xml.XppDriver;
 import hudson.util.XStream2;
+import jenkins.util.xstream.XStreamDOM.ConverterImpl;
 import org.apache.commons.io.IOUtils;
 import org.junit.Before;
 import org.junit.Test;
 
 import static org.junit.Assert.*;
 
 import java.io.IOException;
+import java.io.InputStream;
+import java.io.StringReader;
+import java.io.StringWriter;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
@@ -140,6 +145,16 @@ private void assertXStreamDOMEquals(XStreamDOM expected, XStreamDOM actual) {
                 assertXStreamDOMEquals(expected.getChildren().get(i), actual.getChildren().get(i));
             }
         }
-
+    }
+
+    @Test
+    public void readFromInputStream() throws Exception {
+        for (String name : new String[]{"XStreamDOMTest.data1.xml","XStreamDOMTest.data2.xml"}) {
+            String input = IOUtils.toString(getClass().getResourceAsStream(name));
+            XStreamDOM dom = XStreamDOM.from(new StringReader(input));
+            StringWriter sw = new StringWriter();
+            dom.writeTo(sw);
+            assertEquals(input.trim(),sw.toString().trim());
+        }
     }
 }

core/src/test/resources/jenkins/util/xstream/XStreamDOMTest.data2.xml

@@ -0,0 +1,4 @@
+<foo abc="def">
+  <bar></bar>
+  <zot>abc</zot>
+</foo>