Security by class fields

[thhart]

It would be nice to initialize the security to allow all classes recursively which are referenced members of a class? Or would this harm any security considerations?

[joehni]

Actually, it is always your configuration of XStream. It would be your own risk to use such a functionality. Said that, if you know your object graph, why not. The types with XStream annotations are found the same way. There's actually another proposal to allow automatically all annotated types. You will have just to consider that XStream will test the types against the concrete Java type, which will be rejected if the member is declared e.g. using an interface.