title: Spring boot - Security framework of XStream not initialized, XStream is probably vulnerable
body: <p>I'm getting the error when upgrading to Boot 2.0 and updated XStream libraries: </p>
  
  <pre><code>Security framework of XStream not initialized, XStream is probably vulnerable.
  </code></pre>
  
  <p>I've found other info out there, but not much related to Spring boot. I'm using an XStreamMarshaller to marshal some objects. Any advice on how to get rid of it?</p>
  
  <p>Environment: Spring boot 2.0 and XStream 1.4.10</p>
  
  <p>I have the following marshaller bean:</p>
  
  <pre><code>@Bean
  public XStreamMarshaller sparkyMarshaller() {
      Map&lt;String, Class&lt;?&gt;&gt; myMap = new HashMap&lt;&gt;();
      myMap.put("Sparky", Sparky.class);
  
      XStreamMarshaller xstreamMarshaller = new XStreamMarshaller();
      xstreamMarshaller.setAliases(myMap);
      xstreamMarshaller.setSupportedClasses(Sparky.class);
  
  
      return xstreamMarshaller;
  }
  </code></pre>
  
  <p>Which I then autowire into business logic. Elsewhere it says to set the permissions, but haven't had any luck with doing that. Anyone have an example of how this may work?</p>