Javadoc of XStream#setCollectionUpdateLimit seems wrong

[daniel-beck]

According to

xstream/xstream/src/java/com/thoughtworks/xstream/XStream.java

Line 1201 in 61a00fa

* @param maxSeconds limit in seconds or 0 to disable check

setting the limit to 0 disables the protection.

Per

xstream/xstream/src/java/com/thoughtworks/xstream/XStream.java

Line 1414 in 61a00fa

if (collectionUpdateLimit >= 0) {

and

xstream/xstream/src/java/com/thoughtworks/xstream/XStream.java

Line 2088 in 61a00fa

if (collectionUpdateLimit >= 0) {

it seems 0 is a legal value to be set for the context limit.

Additionally,

xstream/xstream/src/java/com/thoughtworks/xstream/core/SecurityUtils.java

Lines 43 to 45 in 61a00fa

	final Integer limit = (Integer)context.get(XStream.COLLECTION_UPDATE_LIMIT);
	if (limit == null) {
	throw new ConversionException("Missing limit for updating collections.");

has no special behavior for 0.

It looks like callers need to pass negative values to skip setting the context values and disable the protection.

[joehni]

Thanks for heads-up. Well, the Javadoc is right, the implementation is wrong. The entries in the data holder should not be created when the limit is 0. However, SecurityUtils is correct. Either seconds are counted, then you need a limit, or not.

[renjanmenon]

Is this a bug that needs to be fixed ? I'm unable to locate collectionUpdateLimit nor SecurityUtils in master .