private XStream xstream() { XStream xstream = new XStream(); // allow annotations on models for maximum flexibility xstream.autodetectAnnotations(true); // prevent xstream from creating complex XML graphs xstream.setMode(XStream.NO_REFERENCES); // setup security (see http://x-stream.github.io/security.html) xstream.allowTypes(WhitelistObjectInputStream.getWhiteClassNames()); xstream.allowTypesByRegExp(WhitelistObjectInputStream.getWhiteRegEx()); return xstream; }