    public static Document toXml(final List<IBaseDataObject> list) {
        final Element root = new Element("payload-list");
        for (final IBaseDataObject d : list) {
            final Document doc = toXml(d);
            root.addContent(doc.detachRootElement());
            logger.debug("Adding xml content for " + d.shortName() + " to document");
        }
        final Document doc = new Document(root);
        return doc;
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.