// [CRUCIBLE-SEED]
// category: deserialization
// severity: critical
// language: java
// expected: Unsafe deserialization via XMLDecoder on user-supplied XML

import java.beans.XMLDecoder;
import java.io.*;
import javax.servlet.http.*;

public class XmlConfigServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        // Vulnerable: XMLDecoder can execute arbitrary Java code via crafted XML
        XMLDecoder decoder = new XMLDecoder(req.getInputStream());
        Object config = decoder.readObject();
        decoder.close();
        resp.getWriter().println("Loaded config: " + config.getClass().getName());
    }
}