Error when converting XML to Object using Xstream

Question

I simulated in a smaller project the same error you are presenting in my original project to make the problem clearer. Follow Code and Error Log.

Xmlconverter

import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.io.xml.DomDriver;
import javax.swing.JOptionPane;

public class XmlConverter {

    public static void main(String[] args) {
        JOptionPane.showMessageDialog(null, "O resultado é exibido no console.");

        String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
                    "<receiptList xmlns=\"dsReceipt.xsd\">\n" +
                    " <receipt order_id=\"5\">\n" +
                    " <receipt_shopper order_id=\"5\" shopper_id=\"1\" ship_to_name=\"João da Silva\" ship_to_address1=\"Rua Alfredo Heisler\" ship_to_address2=\"Curitiba\" ship_to_address3=\"PR\" ship_to_address4=\"82600470\" ship_to_phone=\"3066-3055\" ship_to_country=\"BRA\" ship_to_ddd_phone=\"41\" shopper_cpf=\"88427867301\" ship_to_street_number=\"83\" ship_to_street_compl=\"apto 102b\" ship_to_district=\"Bacacheri\" reference=\"perto do quartel\" />\n" +
                    " <receipt_billing order_id=\"5\" name=\"João da Silva\" email=\"[email protected]\" customer_type=\"Person\" document_type=\"Cpf\" document_id=\"88427867301\" regional_document_type=\"Rg\" regional_document_id=\"57490000\" regional_document_state=\"PR\" street=\"Rua Alfredo Heisler\" street_number=\"83\" street_complement=\"apto 102b\" district=\"Bacacheri\" city=\"Curitiba\" state=\"PR\" country=\"BRA\" zip_code=\"82600470\" reference=\"perto ao quartel\" phone_area_code=\"41\" phone_number=\"3559-3055\" phone_area_code_alternative=\"41\" phone_number_alternative=\"9521-3425\" gender=\"Male\" birth_date=\"1976-09-21T00:00:00-03:00\" />\n" +
                    " </receipt>\n" +
                    "</receiptList>";

        try {           
            XStream xstream = new XStream(new DomDriver()); 
            xstream.alias("receipt_billing", ReceiptBilling.class);
            xstream.alias("receipt_shopper", ReceiptShopper.class);
            xstream.alias("receipt", Receipt.class);
            xstream.alias("receiptList", ReceiptList.class);
            ReceiptList receiptList = (ReceiptList) xstream.fromXML(xml);

            System.out.println("Receipt - Order Id: " + receiptList.getReceipt().get(0).getOrder_id());
            System.out.println("Receipt - Receipt Shopper - Reference: " + receiptList.getReceipt().get(0).getReceipt_shopper().getReference());            

        } catch (NullPointerException e1) {
            e1.printStackTrace();
        }  
    }

}

Receipt

import com.thoughtworks.xstream.annotations.XStreamAlias;

@XStreamAlias("receipt")
public class Receipt {
    private ReceiptShopper receipt_shopper;

    private String order_id;

    private ReceiptBilling receipt_billing;

    public ReceiptShopper getReceipt_shopper ()
    {
        return receipt_shopper;
    }

    public void setReceipt_shopper (ReceiptShopper receipt_shopper)
    {
        this.receipt_shopper = receipt_shopper;
    }

    public String getOrder_id ()
    {
        return order_id;
    }

    public void setOrder_id (String order_id)
    {
        this.order_id = order_id;
    }

    public ReceiptBilling getReceipt_billing ()
    {
        return receipt_billing;
    }

    public void setReceipt_billing (ReceiptBilling receipt_billing)
    {
        this.receipt_billing = receipt_billing;
    }
}

Receiptbilling

 import com.thoughtworks.xstream.annotations.XStreamAlias;

@XStreamAlias("receipt_billing")
public class ReceiptBilling {
    private String phone_area_code;

    private String phone_number;

    private String regional_document_state;

    private String birth_date;

    private String zip_code;

    private String document_id;

    private String street;

    private String state;

    private String regional_document_type;

    private String phone_area_code_alternative;

    private String order_id;

    private String phone_number_alternative;

    private String document_type;

    private String customer_type;

    private String reference;

    private String city;

    private String country;

    private String email;

    private String name;

    private String gender;

    private String street_number;

    private String district;

    private String street_complement;

    private String regional_document_id;

    public String getPhone_area_code ()
    {
        return phone_area_code;
    }

    public void setPhone_area_code (String phone_area_code)
    {
        this.phone_area_code = phone_area_code;
    }

    public String getPhone_number ()
    {
        return phone_number;
    }

    public void setPhone_number (String phone_number)
    {
        this.phone_number = phone_number;
    }

    public String getRegional_document_state ()
    {
        return regional_document_state;
    }

    public void setRegional_document_state (String regional_document_state)
    {
        this.regional_document_state = regional_document_state;
    }

    public String getBirth_date ()
    {
        return birth_date;
    }

    public void setBirth_date (String birth_date)
    {
        this.birth_date = birth_date;
    }

    public String getZip_code ()
    {
        return zip_code;
    }

    public void setZip_code (String zip_code)
    {
        this.zip_code = zip_code;
    }

    public String getDocument_id ()
    {
        return document_id;
    }

    public void setDocument_id (String document_id)
    {
        this.document_id = document_id;
    }

    public String getStreet ()
    {
        return street;
    }

    public void setStreet (String street)
    {
        this.street = street;
    }

    public String getState ()
    {
        return state;
    }

    public void setState (String state)
    {
        this.state = state;
    }

    public String getRegional_document_type ()
    {
        return regional_document_type;
    }

    public void setRegional_document_type (String regional_document_type)
    {
        this.regional_document_type = regional_document_type;
    }

    public String getPhone_area_code_alternative ()
    {
        return phone_area_code_alternative;
    }

    public void setPhone_area_code_alternative (String phone_area_code_alternative)
    {
        this.phone_area_code_alternative = phone_area_code_alternative;
    }

    public String getOrder_id ()
    {
        return order_id;
    }

    public void setOrder_id (String order_id)
    {
        this.order_id = order_id;
    }

    public String getPhone_number_alternative ()
    {
        return phone_number_alternative;
    }

    public void setPhone_number_alternative (String phone_number_alternative)
    {
        this.phone_number_alternative = phone_number_alternative;
    }

    public String getDocument_type ()
    {
        return document_type;
    }

    public void setDocument_type (String document_type)
    {
        this.document_type = document_type;
    }

    public String getCustomer_type ()
    {
        return customer_type;
    }

    public void setCustomer_type (String customer_type)
    {
        this.customer_type = customer_type;
    }

    public String getReference ()
    {
        return reference;
    }

    public void setReference (String reference)
    {
        this.reference = reference;
    }

    public String getCity ()
    {
        return city;
    }

    public void setCity (String city)
    {
        this.city = city;
    }

    public String getCountry ()
    {
        return country;
    }

    public void setCountry (String country)
    {
        this.country = country;
    }

    public String getEmail ()
    {
        return email;
    }

    public void setEmail (String email)
    {
        this.email = email;
    }

    public String getName ()
    {
        return name;
    }

    public void setName (String name)
    {
        this.name = name;
    }

    public String getGender ()
    {
        return gender;
    }

    public void setGender (String gender)
    {
        this.gender = gender;
    }

    public String getStreet_number ()
    {
        return street_number;
    }

    public void setStreet_number (String street_number)
    {
        this.street_number = street_number;
    }

    public String getDistrict ()
    {
        return district;
    }

    public void setDistrict (String district)
    {
        this.district = district;
    }

    public String getStreet_complement ()
    {
        return street_complement;
    }

    public void setStreet_complement (String street_complement)
    {
        this.street_complement = street_complement;
    }

    public String getRegional_document_id ()
    {
        return regional_document_id;
    }

    public void setRegional_document_id (String regional_document_id)
    {
        this.regional_document_id = regional_document_id;
    }

}

Receiptlist

   import com.thoughtworks.xstream.annotations.XStreamAlias;
import com.thoughtworks.xstream.annotations.XStreamImplicit;
import java.util.List;

@XStreamAlias("receiptList")
public class ReceiptList {

    @XStreamImplicit(itemFieldName = "receipt")
    private List<Receipt> receipt;

    private String xmlns;

    public List<Receipt> getReceipt ()
    {
        return receipt;
    }

    public void setReceipt (List<Receipt> receipt)
    {
        this.receipt = receipt;
    }

    public String getXmlns ()
    {
        return xmlns;
    }

    public void setXmlns (String xmlns)
    {
        this.xmlns = xmlns;
    }

}

Receiptshopper

   import com.thoughtworks.xstream.annotations.XStreamAlias;

@XStreamAlias("receipt_shopper")
public class ReceiptShopper {
    private String ship_to_address2;

    private String ship_to_address1;

    private String order_id;

    private String shopper_cpf;

    private String reference;

    private String ship_to_name;

    private String ship_to_address4;

    private String ship_to_address3;

    private String ship_to_street_number;

    private String ship_to_street_compl;

    private String ship_to_ddd_phone;

    private String ship_to_district;

    private String ship_to_phone;

    private String shopper_id;

    private String ship_to_country;

    public String getShip_to_address2 ()
    {
        return ship_to_address2;
    }

    public void setShip_to_address2 (String ship_to_address2)
    {
        this.ship_to_address2 = ship_to_address2;
    }

    public String getShip_to_address1 ()
    {
        return ship_to_address1;
    }

    public void setShip_to_address1 (String ship_to_address1)
    {
        this.ship_to_address1 = ship_to_address1;
    }

    public String getOrder_id ()
    {
        return order_id;
    }

    public void setOrder_id (String order_id)
    {
        this.order_id = order_id;
    }

    public String getShopper_cpf ()
    {
        return shopper_cpf;
    }

    public void setShopper_cpf (String shopper_cpf)
    {
        this.shopper_cpf = shopper_cpf;
    }

    public String getReference ()
    {
        return reference;
    }

    public void setReference (String reference)
    {
        this.reference = reference;
    }

    public String getShip_to_name ()
    {
        return ship_to_name;
    }

    public void setShip_to_name (String ship_to_name)
    {
        this.ship_to_name = ship_to_name;
    }

    public String getShip_to_address4 ()
    {
        return ship_to_address4;
    }

    public void setShip_to_address4 (String ship_to_address4)
    {
        this.ship_to_address4 = ship_to_address4;
    }

    public String getShip_to_address3 ()
    {
        return ship_to_address3;
    }

    public void setShip_to_address3 (String ship_to_address3)
    {
        this.ship_to_address3 = ship_to_address3;
    }

    public String getShip_to_street_number ()
    {
        return ship_to_street_number;
    }

    public void setShip_to_street_number (String ship_to_street_number)
    {
        this.ship_to_street_number = ship_to_street_number;
    }

    public String getShip_to_street_compl ()
    {
        return ship_to_street_compl;
    }

    public void setShip_to_street_compl (String ship_to_street_compl)
    {
        this.ship_to_street_compl = ship_to_street_compl;
    }

    public String getShip_to_ddd_phone ()
    {
        return ship_to_ddd_phone;
    }

    public void setShip_to_ddd_phone (String ship_to_ddd_phone)
    {
        this.ship_to_ddd_phone = ship_to_ddd_phone;
    }

    public String getShip_to_district ()
    {
        return ship_to_district;
    }

    public void setShip_to_district (String ship_to_district)
    {
        this.ship_to_district = ship_to_district;
    }

    public String getShip_to_phone ()
    {
        return ship_to_phone;
    }

    public void setShip_to_phone (String ship_to_phone)
    {
        this.ship_to_phone = ship_to_phone;
    }

    public String getShopper_id ()
    {
        return shopper_id;
    }

    public void setShopper_id (String shopper_id)
    {
        this.shopper_id = shopper_id;
    }

    public String getShip_to_country ()
    {
        return ship_to_country;
    }

    public void setShip_to_country (String ship_to_country)
    {
        this.ship_to_country = ship_to_country;
    }

}

Error

Security framework of XStream not initialized, XStream is probably vulnerable.
Exception in thread "main" com.thoughtworks.xstream.converters.ConversionException: Invalid reference
---- Debugging information ----
message             : Invalid reference
reference           : perto do quartel
referenced-type     : xmlconverter.ReceiptShopper
referenceable       : true
class               : java.util.ArrayList
required-type       : java.util.ArrayList
converter-type      : com.thoughtworks.xstream.converters.collections.CollectionConverter
path                : /receiptList/receipt/receipt_shopper
class[1]            : xmlconverter.ReceiptList
required-type[1]    : xmlconverter.ReceiptList
converter-type[1]   : com.thoughtworks.xstream.converters.reflection.ReflectionConverter
version             : 1.4.11.1
-------------------------------
    at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:58)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:50)
    at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.readBareItem(AbstractCollectionConverter.java:132)
    at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.readItem(AbstractCollectionConverter.java:117)
    at com.thoughtworks.xstream.converters.collections.CollectionConverter.addCurrentElementToCollection(CollectionConverter.java:98)
    at com.thoughtworks.xstream.converters.collections.CollectionConverter.populateCollection(CollectionConverter.java:91)
    at com.thoughtworks.xstream.converters.collections.CollectionConverter.populateCollection(CollectionConverter.java:85)
    at com.thoughtworks.xstream.converters.collections.CollectionConverter.unmarshal(CollectionConverter.java:80)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
    at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:72)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
    at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.unmarshallField(AbstractReflectionConverter.java:499)
    at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.doUnmarshal(AbstractReflectionConverter.java:425)
    at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.unmarshal(AbstractReflectionConverter.java:277)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
    at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:72)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:50)
    at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:134)
    at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)
    at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1487)
    at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1467)
    at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1338)
    at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1329)
    at xmlconverter.XmlConverter.main(XmlConverter.java:31)

XML

<?xml version="1.0" encoding="UTF-8"?>
<receiptList xmlns="dsReceipt.xsd">
 <receipt order_id="5">
 <receipt_shopper order_id="5" shopper_id="1" ship_to_name="João da Silva" ship_to_address1="Rua Alfredo Heisler" ship_to_address2="Curitiba" ship_to_address3="PR" ship_to_address4="82600470" ship_to_phone="3066-3055" ship_to_country="BRA" ship_to_ddd_phone="41" shopper_cpf="88427867301" ship_to_street_number="83" ship_to_street_compl="apto 102b" ship_to_district="Bacacheri" reference="perto do quartel" />
 <receipt_billing order_id="5" name="João da Silva" email="[email protected]" customer_type="Person" document_type="Cpf" document_id="88427867301" regional_document_type="Rg" regional_document_id="57490000" regional_document_state="PR" street="Rua Alfredo Heisler" street_number="83" street_complement="apto 102b" district="Bacacheri" city="Curitiba" state="PR" country="BRA" zip_code="82600470" reference="perto ao quartel" phone_area_code="41" phone_number="3559-3055" phone_area_code_alternative="41" phone_number_alternative="9521-3425" gender="Male" birth_date="1976-09-21T00:00:00-03:00" />
 </receipt>
</receiptList>

Download Xstream

Answer 1

It seems to me there are three problems:

1. Most of your tags use attributes, but you’re not indicating it anywhere;
2. You didn’t call the method XStream.processAnnotations() to indicate that the XStream should process the annotations you made in the classes;
3. In your class ReceiptShopper there is an attribute with name reference, which appears to be an attribute name system-reserved, and that’s exactly where the error is.

(1)
Then try to configure the fields of your class with the annotation @XStreamAsAttribute (annotation tutorial):

@XStreamAlias("receipt")
public class Receipt {
    private ReceiptShopper receipt_shopper;

    @XStreamAsAttribute
    private String order_id;

    private ReceiptBilling receipt_billing;
    // [...]
}

@XStreamAlias("receipt_shopper")
public class ReceiptShopper {
    @XStreamAsAttribute
    private String ship_to_address2;

    @XStreamAsAttribute
    private String ship_to_address1;

    @XStreamAsAttribute
    private String order_id;

    @XStreamAsAttribute
    private String shopper_cpf;

    @XStreamAsAttribute
    private String reference;
    // [...]
}

@XStreamAlias("receipt_billing")
public class ReceiptBilling {
    @XStreamAsAttribute
    private String phone_area_code;

    @XStreamAsAttribute
    private String phone_number;

    @XStreamAsAttribute
    private String regional_document_state;

    @XStreamAsAttribute
    private String birth_date;
    // [...]
}

(2 and 3)
When deserializing XML, use the method XStream.processAnnotations() (documentation) to solve item 2 and method XStream.aliasSystemAttribute() (documentation) to resolve item 3:

XStream xstream = new XStream(new DomDriver()); 

xstream.alias("receiptList", ReceiptList.class);
xstream.alias("receipt", Receipt.class);
xstream.alias("receipt_shopper", ReceiptShopper.class);
xstream.alias("receipt_billing", ReceiptBilling.class);

xstream.aliasSystemAttribute("systemReference", "reference");

xstream.processAnnotations(
   new Class[]{
      ReceiptList.class,
      Receipt.class,
      ReceiptShopper.class,
      ReceiptBilling.class
   });

ReceiptList receiptList = (ReceiptList) xstream.fromXML(xml);

---

EDITION

I don’t know if it will be necessary, but maybe you also have to use the methods XStream.setupDefaultSecurity() (documentation and FAQ) and XStream.allowTypes (documentation and Security Aspects), as in reply from Soen:

Class[] classes = new Class[] {
   ReceiptList.class,
   Receipt.class,
   ReceiptShopper.class,
   ReceiptBilling.class
};

XStream xstream = new XStream(new DomDriver()); 
// A partir da versão 1.5 esse método não fará nada.
XStream.setupDefaultSecurity(xstream);
xstream.allowTypes(classes);
xstream.alias("receiptList", ReceiptList.class);
xstream.alias("receipt", Receipt.class);
xstream.alias("receipt_shopper", ReceiptShopper.class);
xstream.alias("receipt_billing", ReceiptBilling.class);
xstream.aliasSystemAttribute("systemReference", "reference");
xstream.processAnnotations(classes);

ReceiptList receiptList = (ReceiptList) xstream.fromXML(xml);