### Question:
SimpleXStreamSerializer implements OpenmrsSerializer { @Override @SuppressWarnings("unchecked") public <T> T deserialize(String serializedObject, Class<? extends T> clazz) throws SerializationException { try { return (T) xstream.fromXML(serializedObject); } catch (XStreamException e) { throw new SerializationException("Unable to deserialize class: " + clazz.getName(), e); } } SimpleXStreamSerializer();  SimpleXStreamSerializer(XStream customXstream); XStream getXstream(); @Override String serialize(Object o); @Override @SuppressWarnings("unchecked") T deserialize(String serializedObject, Class<? extends T> clazz); public XStream xstream; }### Answer:
@Test public void deserialize_shouldDeserializeStringToClassInstance() throws SerializationException { String serializedFoo = "<org.openmrs.serialization.Foo>\n" + " <attributeString>Testing</attributeString>\n" + " <attributeInt>4</attributeInt>\n" + " <attributeList>\n" + " <string>fooBar</string>\n" + " <string>bar</string>\n" + " </attributeList>\n" + " <attributeMap>\n" + " <entry>\n" + " <int>10</int>\n" + " <string>foo</string>\n" + " </entry>\n" + " <entry>\n" + " <int>20</int>\n" + " <string>fooBar</string>\n" + " </entry>\n" + " <entry>\n" + " <int>30</int>\n" + " <string>bar</string>\n" + " </entry>\n" + " </attributeMap>\n" + "</org.openmrs.serialization.Foo>"; OpenmrsSerializer serializer = new SimpleXStreamSerializer(); Foo foo = serializer.deserialize(serializedFoo, Foo.class); Assert.assertTrue(foo.getAttributeString().equals("Testing")); Assert.assertTrue(foo.getAttributeInt() == 4); List newList = foo.getAttributeList(); Assert.assertTrue(newList.size() == 2); Assert.assertTrue(newList.get(0).equals("fooBar")); Assert.assertTrue(newList.get(1).equals("bar")); Map newMap = foo.getAttributeMap(); Assert.assertTrue(newMap.size() == 3); Assert.assertTrue(newMap.get(10).equals("foo")); Assert.assertTrue(newMap.get(20).equals("fooBar")); Assert.assertTrue(newMap.get(30).equals("bar")); }
@Test public void deserialize_shouldNotDeserializeProxies() throws SerializationException { String serialized = "<dynamic-proxy>" + "<interface>org.openmrs.OpenmrsObject</interface>" + "<handler class=\"java.beans.EventHandler\">" + "<target class=\"java.lang.ProcessBuilder\">" + "<command>" + "<string>someApp</string>" + "</command></target>" + "<action>start</action>" + "</handler>" + "</dynamic-proxy>"; expectedException.expect(SerializationException.class); new SimpleXStreamSerializer().deserialize(serialized, OpenmrsObject.class); }
@Test public void deserialize_shouldIgnoreEntities() throws SerializationException { String xml = "<!DOCTYPE ZSL [<!ENTITY xxe1 \"some attribute value\" >]>" + "<org.openmrs.serialization.Foo>" + "<attributeString>&xxe1;</attributeString>" + "</org.openmrs.serialization.Foo>"; expectedException.expect(SerializationException.class); new SimpleXStreamSerializer().deserialize(xml, Foo.class); }