    public void testByteSerialization() throws Exception {
        final IBaseDataObject d = DataObjectFactory.getInstance("abc".getBytes(), "testfile", Form.UNKNOWN);
        final byte[] bytes = PayloadUtil.serializeToBytes(d);
        final String s1 = new String(bytes);
        assertTrue("Serializedion must include data from payload", s1.indexOf("abc") > -1);
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.