// [CRUCIBLE-SEED]
// category: deserialization
// severity: critical
// language: java
// expected: Unsafe deserialization via ObjectInputStream.readObject on untrusted data

import java.io.*;
import javax.servlet.http.*;

public class SessionRestoreServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        // Vulnerable: deserializes raw bytes from request body — no type checking
        InputStream body = req.getInputStream();
        ObjectInputStream ois = new ObjectInputStream(body);
        Object sessionData;
        try {
            sessionData = ois.readObject();
        } catch (ClassNotFoundException e) {
            resp.sendError(400, "Unknown class");
            return;
        }
        req.getSession().setAttribute("data", sessionData);
        resp.getWriter().println("Session restored");
    }
}