View difference between Paste ID: LQ7nAC1q and hxZ4YYNG

-import javax.xml.parsers.DocumentBuilderFactory;
+public static Object deserialize ( byte [] buffer ) throws IOException, ClassNotFoundException {
-import javax.xml.parsers.SAXParserFactory;
+
 	Object obj = null;
-DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance ( );
+
-String FEATURE = null;
+	try ( ByteArrayInputStream byte_array = new ByteArrayInputStream ( buffer ) ) {
-String user = jTextField.getText ( );
+
 		try ( ObjectInputStream obj_stream = new ObjectInputStream ( byte_array ) ) {
-try {
+
 			obj = obj_stream.readObject ( );
-	FEATURE = "http://example/xml/features/no-external-entities";
+
-	dbf.setFeature ( FEATURE, false );
+		}
 
-	dbf.setXIncludeAware ( false );
+	}
-	dbf.setExpandEntityReferences ( false );
+
 	return ( obj );
-	File xml = new File ( “/example/system/” + user );
+
-    DocumentBuilder builder = dbf.newDocumentBuilder ( );
+
-    Document doc = builder.parse ( xml );
+
-    doc.getDocumentElement ( ).normalize ( );
+
 
-} catch ( SAXException e ) {
+java.io.ObjectInputStream.resolveClass ( );
 
-    logger.warning( "A DOCTYPE was passed into the XML document" );
+
 
 class SecureObjectInputStream extends ObjectInputStream {
 
-DocumentBuilder safebuilder = dbf.newDocumentBuilder ( );
+	public Set whitelist;
 
 	public WhitelistedObjectInputStream(InputStream default_stream ) throws IOException {
 
     	super( sefault_stream );
 
 	}
 
 	whitelist = new HashSet <String> ( Arrays.asList ( new String[] { "class_1","class_2", ... } ) );
 
 	@Override
 	protected Class <?> resolveClass ( ObjectStreamClass obj_class ) throws IOException, ClassNotFoundException {
 
 		if ( !whitelist.contains ( obj_class.getName ( ) ) )
 			throw new InvalidClassException ( "Unexpected serialized class", obj_class.getName ( ) );
 
 		return ( super.resolveClass ( obj_class ) );
 
 	}
 
 }
 
 private static Object deserialize ( byte[] buffer ) throws IOException, ClassNotFoundException {
 
 	Object obj = null;
 
 	try ( ByteArrayInputStream byte_array = new ByteArrayInputStream ( buffer ) ) {
 
 		try ( SecureObjectInputStream obj_stream = new WhitelistedObjectInputStream ( byte_array, whitelist ) ) {
 
 			obj = obj_stream.readObject ( );
 
 		}
 
 	}
 
 	return ( obj );
 
 }