class XmlMarshaller {

    public static Object unMarshal(String input, Object object) throws MarshallerException {

        try {
            SAXParserFactory spf = SAXParserFactory.newInstance();
            spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
            spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
            spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            spf.setNamespaceAware(true);
            XMLReader xmlReader = spf.newSAXParser().getXMLReader();

            JAXBContext jaxbContext = JAXBContext.newInstance(object.getClass());
            Unmarshaller jaxbUnmarshaller = jaxbContext.createUnmarshaller();

            InputSource inputSource = new InputSource(new StringReader(input));
            SAXSource source = new SAXSource(xmlReader, inputSource);
            object = jaxbUnmarshaller.unmarshal(source, object.getClass()).getValue();
        } catch (Exception e) {
            logger.error(LoggingAnchor.THREE, MessageEnum.GENERAL_EXCEPTION.toString(),
                    ErrorCode.SchemaError.getValue(), e.getMessage(), e);
            throw new MarshallerException(e.getMessage(), ErrorCode.SchemaError.getValue(), e);
        }

        return object;
    }

}