Language: Java
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
	public IOrderInfoProvider readOrderInfo() throws IOException {
		ItemIdentifierStack stack = readItemIdentifierStack();
		int routerId = localBuffer.readInt();
		boolean isFinished = localBuffer.readBoolean();
		boolean inProgress = localBuffer.readBoolean();
		IOrderInfoProvider.ResourceType type = readEnum(IOrderInfoProvider.ResourceType.class);
		List<Float> list = readArrayList(LPDataInput::readFloat);
		byte machineProgress = localBuffer.readByte();
		DoubleCoordinates pos = readLPPosition();
		ItemIdentifier ident = readItemIdentifier();
		return new ClientSideOrderInfo(stack, isFinished, type, inProgress, routerId, list, machineProgress, pos, ident);
	}