title: Is it safe to use XMLDecoder to read document files?
body: <p>Serializing Java Beans to XML using <a href="http://docs.oracle.com/javase/7/docs/api/index.html?java/beans/XMLEncoder.html" rel="noreferrer"><code>XMLEncoder</code></a> and <a href="http://docs.oracle.com/javase/7/docs/api/index.html?java/beans/XMLDecoder.html" rel="noreferrer"><code>XMLDecoder</code></a> seems like a pretty neat approach: many classes from many sources can be serialized reliably, just using their public interface. Using this aproach to serialization is even suggested in many places of the API reference. But the <a href="http://www.oracle.com/technetwork/java/persistence3-139471.html" rel="noreferrer">XML syntax</a> used for this seems quite powerful. Are there any security mechanisms which will prevent attacks originating from malicious documents? Or should the use of <code>XMLDecoder</code> on untrusted documents be avoided for security reasons?</p>