    public int addFileName(String file) {
        workUnitList.add(new WorkUnit(file));
        return size();
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.