// Passive Java deserialization fixture only
import java.io.Serializable;
import java.io.ObjectInputStream;
class VulnerableUser implements java.io.Serializable {
    private ObjectInputStream input;
}