public Object deserialize(byte[] serialized) {
        if (serialized == null) {
            throw new IllegalArgumentException("Argument cannot be null.");
        }
        ByteArrayInputStream bis = new ByteArrayInputStream(serialized);
        XMLDecoder decoder = new XMLDecoder(new BufferedInputStream(bis));
        Object o = decoder.readObject();
        decoder.close();
        return o;
    }
Deserializes the specified <code>serialized</code> source back into an Object by using a
{@link java.io.ByteArrayInputStream ByteArrayInputStream} to wrap the argument and then decode this
stream via an {@link java.beans.XMLDecoder XMLDecoder}, where the
{@link java.beans.XMLDecoder#readObject() readObject} call results in the original Object to return.

@param serialized the byte[] array representation of the XML encoded output.
@return the original source Object in reconstituted form.
lang/src/main/java/org/apache/shiro/lang/io/XmlSerializer.java