XMLDecoder decoder = new XMLDecoder(new InputSource(new InputStreamReader(request.getInputStream(), "UTF-8")));

  Object object = decoder.readObject();
  decoder.close();

  <java>
    <object class="java.lang.ProcessBuilder">
      <array class="java.lang.String" length="1" >
        <void index="0">
          <string>c:\\windows\\system32\\calc.exe</string>
        </void>
      </array>
      <void method="start"/>
    </object>
  </java>

String expression = request.getParameter("input");
SpelExpressionParser parser = new SpelExpressionParser();
SpelExpression expr = parser.parseRaw(expression);

    <spring:message text="" code="${param['message']}"></spring:message>

...
myWebView.loadUrl("file:///android_asset/www/index.html");
...

  <script src="http://www.example.com/js/fancyWidget.js"></script>

...
String returnURL = request.getParameter("returnURL");
	RequestDispatcher rd = request.getRequestDispatcher(returnURL);
	rd.forward();
...

...
	<% String returnURL = request.getParameter("returnURL"); %>
	<jsp:include page="<%=returnURL%>" />
	...

...
	String returnURL = request.getParameter("returnURL");
	return new ModelAndView(returnURL);
	...

<webflow:end-state id="finalStep" view="${requestParameters.url}"/>
<webflow:view-state id="showView" view="${requestParameters.test}">

<bean class="org.springframework.web.servlet.view.
               InternalResourceViewResolver">
    <property name="prefix" value="/WEB-INF/views/" />
    <property name="suffix" value=".jsp" />
</bean>

...
	String returnURL = request.getParameter("returnURL");
	return new ActionForward(returnURL);
	...

  String permissionMask = System.getProperty("defaultFileMask");
  Path filePath = userFile.toPath();
  ...
  Set<PosixFilePermission> perms = PosixFilePermissions.fromString(permissionMask);
  Files.setPosixFilePermissions(filePath, perms);
...

<logging>
    <target class="flex.messaging.log.ConsoleTarget" level="Debug">
        <properties>
            <prefix>[BlazeDS]</prefix>
            <includeDate>false</includeDate>
            <includeTime>false</includeTime>
            <includeLevel>false</includeLevel>
            <includeCategory>false</includeCategory>
        </properties>
        <filters>
            <pattern>Endpoint.*</pattern>
            <pattern>Service.*</pattern>
            <pattern>Configuration</pattern>
        </filters>
    </target>
</logging>

    @RequestMapping(value = "/api/service.csv")
    public ResponseEntity<String> service(@RequestParam("name") String name) {

        HttpHeaders responseHeaders = new HttpHeaders();
        responseHeaders.add("Content-Type", "application/csv; charset=utf-8");
        responseHeaders.add("Content-Disposition", "attachment;filename=file.csv");

        String data = generateCSVFor(name);

        return new ResponseEntity<>(data, responseHeaders, HttpStatus.OK);
    }

@Override
public static boolean isFragmentValid(Fragment paramFragment)
{
    return true;
}

...
String badData = getUserInput();
Metadata headers = new Metadata();
headers.put(Metadata.Key.of("sample", Metadata.ASCII_STRING_MARSHALLER), badData);
...

  public static void run(String args[]) throws IOException {

    String path = "/path/to/a/file";
    DFSclient client = new DFSClient(arg[1], new Configuration());
    ClientProtocol nNode = client.getNameNode();

    /* This sets the ownership of a file pointed by the path to a user identified
     * by command line arguments.
     */
    nNode.setOwner(path, args[2], args[3]);
    ...
  }

  public void run(String args[]) throws IOException {

    String inputDir = args[0];
    String outputDir = args[1];

    // Untrusted command line argument
    int numOfReducers = Integer.parseInt(args[3]);
    Class mapper = getClassByName(args[4]);
    Class reducer = getClassByName(args[5]);

    Configuration defaults = new Configuration();
    JobConf job = new JobConf(defaults, OptimizedDataJoinJob.class);
    job.setNumMapTasks(1);
    // An attacker may set random values that exceed the range of acceptable number of reducers
    job.setNumReduceTasks(numOfReducers);

    return job;
  }

  public static void main(String[] args) throws Exception {

    JobID id = JobID.forName(args[0]);
    JobConf conf = new JobConf(WordCount.class);
    // configure this JobConf instance
    ...
    JobClient.runJob(conf);
    RunningJob job = JobClient.getJob(id);
    job.killJob();

  }