How to fix warning "Security framework of XStream" in catalina.out log?

Question

Our catalina.out log is flooded with warnings about the "security framework of XStream".  Does anyone know how to fix or remove the warning message?

Security framework of XStream not initialized, XStream is probably vulnerable.
Security framework of XStream not initialized, XStream is probably vulnerable.
Security framework of XStream not initialized, XStream is probably vulnerable.
Security framework of XStream not initialized, XStream is probably vulnerable.
Security framework of XStream not initialized, XStream is probably vulnerable.
Security framework of XStream not initialized, XStream is probably vulnerable.
Security framework of XStream not initialized, XStream is probably vulnerable.
Security framework of XStream not initialized, XStream is probably vulnerable.
Security framework of XStream not initialized, XStream is probably vulnerable.

Ganesh Gautam · Accepted Answer

@rporteric These errors are shown when XStream allowlist security system is not enabled in a product. This is enabled by calling the following code in the core:

XStream.setUpDefaultSecurity(xstream)

However, since it's a breaking change Confluence would be switching from blocklist to allowlist in a platform release. Till that time, it will be using blocklist mode.

Confluence allows admins to switch to allowlist mode by setting following JVM sysprop to true(but it has potential to break many plugins):

xstream.allowlist.enable

I expect similar thing in Jira.
Please note that XStream 1.5 is expected to default to this behaviour when released.

Thanks,

Ganesh