### Question:
DSWDatasourceServiceImpl implements IDSWDatasourceService { public DatasourceDTO deSerializeModelState( String dtoStr ) throws DatasourceServiceException { XStream xs = new XStream(); xs.setClassLoader( DatasourceDTO.class.getClassLoader() ); if ( dtoStr.startsWith( "<org.pentaho.platform.dataaccess.datasource.wizard.models.DatasourceDTO>" ) && dtoStr.endsWith( "</org.pentaho.platform.dataaccess.datasource.wizard.models.DatasourceDTO>" ) ) { return (DatasourceDTO) xs.fromXML( dtoStr ); } else { logger.error( Messages.getErrorString( "DatasourceServiceImpl.ERROR_0025_STRING_FOR_DESERIALIZATION_IS_NOT_VALID" ) ); throw new DatasourceServiceException( Messages.getErrorString( "DatasourceServiceImpl.ERROR_0025_STRING_FOR_DESERIALIZATION_IS_NOT_VALID" ) ); } } DSWDatasourceServiceImpl();  DSWDatasourceServiceImpl( ConnectionServiceImpl connService ); boolean deleteLogicalModel( String domainId, String modelName ); SerializedResultSet doPreview( String connectionName, String query, String previewLimit ); boolean testDataSourceConnection( String connectionName ); BusinessData generateLogicalModel( String modelName, String connectionName, String dbType, String query,
                                            String previewLimit ); IMetadataDomainRepository getMetadataDomainRepository(); void setMetadataDomainRepository( IMetadataDomainRepository metadataDomainRepository ); boolean saveLogicalModel( Domain domain, boolean overwrite ); boolean hasPermission(); List<LogicalModelSummary> getLogicalModels( String context ); BusinessData loadBusinessData( String domainId, String modelId ); BogoPojo gwtWorkaround( BogoPojo pojo ); String serializeModelState( DatasourceDTO dto ); DatasourceDTO deSerializeModelState( String dtoStr ); List<String> listDatasourceNames(); @Override QueryDatasourceSummary generateQueryDomain( String name, String query, DatabaseConnection connection,
                                                     DatasourceDTO datasourceDTO ); void prepareForSerializaton( Domain domain ); String getDatasourceIllegalCharacters(); @Override GeoContext getGeoContext();  }### Answer:
@Test( expected = DatasourceServiceException.class ) public void testDeSerializeModelStateInvalidString() throws Exception { String notSafeString = "<com.malicious.DatasourceDTO>\n" + " <datasourceName>testDatasource</datasourceName>\n" + " <datasourceType>CSV</datasourceType>\n" + " <csvModelInfo>\n" + " <fileInfo>\n" + " <delimiter>,</delimiter>\n" + " <enclosure>&quot;</enclosure>\n" + " <headerRows>1</headerRows>\n" + " <currencySymbol></currencySymbol>\n" + " <decimalSymbol>.</decimalSymbol>\n" + " <groupSymbol>,</groupSymbol>\n" + " <ifNull>---</ifNull>\n" + " <nullStr></nullStr>\n" + " </fileInfo>\n" + " <stageTableName>testdatasource</stageTableName>\n" + " <validated>false</validated>\n" + " <csvInputErrors/>\n" + " <tableOutputErrors/>\n" + " </csvModelInfo>\n" + " <connectionName>SampleData</connectionName>\n" + " <version>2.0</version>\n" + "</com.malicious.DatasourceDTO>"; dswService.deSerializeModelState( notSafeString ); }