Java对象序列化与反序列化详解

需积分: 9 103 浏览量更新于2024-07-17 收藏 342KB PDF 举报

"Java对象序列化是将Java对象转换为字节流的过程，以便可以存储或在网络上传输。这个过程确保了对象的状态和结构能够被完整地保存和恢复。序列化和反序列化是互逆的过程，后者是从字节流中重建原始对象或对象图。不同版本的类可以读写兼容的序列化流。此规范由Sun Microsystems, Inc.发布，允许创建和分发符合该规范的清洁室实现。" 在Java中，序列化是一个关键的概念，它允许将对象转换为二进制表示形式，以便可以在磁盘上存储或通过网络进行传输。这对于数据持久化、跨进程通信（如RMI）以及分布式计算等场景非常有用。 1. **序列化接口**：要使一个对象可序列化，它必须实现`java.io.Serializable`接口。这个接口是标记接口，没有方法定义，只是表明该类的对象可以被序列化。 2. **序列化过程**：当对象被序列化时，其所有非静态和非transient字段都将被保存。`transient`关键字用于标记那些不希望在序列化过程中保存的字段。而`static`字段由于与类相关联而不是单个对象，因此不会被序列化。 3. **序列化API**： - `java.io.ObjectOutputStream`: 这个类用于将Java对象转换成字节流。它的`writeObject()`方法用于序列化一个对象。 - `java.io.ObjectInputStream`: 反序列化的工具类，使用`readObject()`方法从字节流中恢复对象。 4. **版本兼容性**：Java的序列化系统设计为支持类的版本控制。即使对象的类在序列化后发生了变化，只要序列化接口保持一致，仍可以正确地反序列化。这通过`serialVersionUID`字段实现，它是每个可序列化类的一个特殊字段，用于识别类的不同版本。 5. **序列化代理（Serial Proxy）**：当序列化一个对象时，其实质是序列化一个代理对象，这个代理对象包含了所有必要的信息来重建原始对象。 6. **流式协议**：Java对象序列化使用了一种自描述的流式协议，其中包含类型信息和数据，使得在不同的Java环境中，甚至在不同的JVM之间，都能正确地反序列化对象。 7. **安全性与反序列化攻击**：由于序列化允许代码执行，不安全的反序列化可能会导致安全问题。恶意构造的序列化流可能包含可执行的代码，因此在反序列化时应谨慎处理输入，避免不必要的风险。 8. **替代序列化方案**：除了标准的Java序列化外，还有一些替代方案，例如Google的Protocol Buffers、Apache Avro和JSON序列化库（如Jackson或Gson），它们提供了更高效、更灵活的数据序列化方式。 9. **优化序列化**：对于大型复杂对象或性能敏感的场景，可以通过实现`writeObject()`和`readObject()`方法来自定义序列化和反序列化过程，以提高效率或处理特殊情况。 10. **序列化影响**：序列化不仅影响对象的存储和传输，还可能影响设计决策，例如，是否需要将所有字段都公开，以及如何处理对象状态的变化。 Java对象序列化是开发Java应用程序时不可或缺的一部分，尤其在需要持久化数据、跨进程通信或分布式系统中。理解并熟练掌握序列化机制对于优化应用程序的性能和安全性至关重要。

Page 4 Java™ Object Serialization Specification

ObjectInputStream can be extended to utilize customized information in the

stream about classes or to replace objects that have been deserialized. Refer to the

resolveClass and resolveObject method descriptions for details.

1.4 Object Streams as Containers

Object Serialization produces and consumes a stream of bytes that contain one or more

primitives and objects. The objects written to the stream, in turn, refer to other objects,

which are also represented in the stream. Object Serialization produces just one stream

format that encodes and stores the contained objects.

Each object that acts as a container implements an interface which allows primitives

and objects to be stored in or retrieved from it. These interfaces are the

ObjectOutput and ObjectInput interfaces which:

• Provide a stream to write to and to read from

• Handle requests to write primitive types and objects to the stream

• Handle requests to read primitive types and objects from the stream

Each object which is to be stored in a stream must explicitly allow itself to be stored

and must implement the protocols needed to save and restore its state. Object

Serialization defines two such protocols. The protocols allow the container to ask the

object to write and read its state.

To be stored in an Object Stream, each object must implement either the

Serializable or the Externalizable interface:

• For a Serializable class, Object Serialization can automatically save and

restore fields of each class of an object and automatically handle classes that evolve

by adding fields or supertypes. A serializable class can declare which of its fields

are saved or restored, and write and read optional values and objects.

• For an Externalizable class, Object Serialization delegates to the class

complete control over its external format and how the state of the supertype(s) is

saved and restored.

1.5 Deﬁning Serializable Fields for a Class

The serializable fields of a class can be defined two different ways. Default serializable

fields of a class are defined to be the non-transient and non-static fields. This default

computation can be overridden by declaring a special field in the Serializable

Chapter 1: System Architecture Page 5

class, serialPersistentFields. This field must be initialized with an array of

ObjectStreamField objects that list the names and types of the serializable fields.

The modifiers for the field are required to be private, static, and final.

For example, the following declaration duplicates the default behavior.

class List implements Serializable {

List next;

private static final ObjectStreamField[] serialPersistentFields

= {new ObjectStreamField(“next”, List.class)};

}

By using serialPersistentFields to define the Serializable fields for a class,

there no longer is a limitation that a serializable field must be a field within the current

definition of the Serializable class. The writeObject and readObject

methods of the Serializable class can map the current implementation of the class

to the serializable fields of the class using the interface that is described in Section 1.7,

“Accessing Serializable Fields of a Class.” Therefore, the fields for a Serializable

class can change in a later release, as long as it maintains the mapping back to its

Serializable fields that must remain compatible across release boundaries.

Note – There is, however, a limitation to the use of this mechanism to specify

serializable fields for inner classes. Inner classes can only contain final static fields that

are initialized to constants or expressions built up from constants. Consequently, it is

not possible to set serialPersistentFields for an inner class (though it is

possible to set it for static member classes). For other restrictions pertaining to

serialization of inner class instances, see section Section 1.10, “The Serializable

Interface”.

1.6 Documenting Serializable Fields and Data for a Class

It is important to document the serializable state of a class to enable interoperability

with alternative implementations of a Serializable class and to document class

evolution. Documenting a serializable field gives one a final opportunity to review

whether or not the field should be serializable. The serialization javadoc tags,

@serial, @serialField, and @serialData, provide a way to document the

serialized form for a Serializable class within the source code.

Page 6 Java™ Object Serialization Specification

• The @serial tag should be placed in the javadoc comment for a default

serializable field. The syntax is as follows:

@serial field-description

The optional field-description describes the meaning of the field and its acceptable

values. The field-description can span multiple lines. When a field is added after the

initial release, a @since tag indicates the version the field was added. The field-

description for @serial provides serialization-specific documentation and is

appended to the javadoc comment for the field within the serialized form

documentation.

• The @serialField tag is used to document an ObjectStreamField component

of a serialPersistentFields array. One of these tags should be used for each

ObjectStreamField component. The syntax is as follows:

@serialField field-name field-type field-description

• The @serialData tag describes the sequences and types of data written or read.

The tag describes the sequence and type of optional data written by writeObject

or all data written by the Externalizable.writeExternal method. The

syntax is as follows:

@serialData data-description

The javadoc application recognizes the serialization javadoc tags and generates a

specification for each Serializable and Externalizable class. See Section C.1, “Example

Alternate Implementation of java.io.File” for an example that uses these tags.

When a class is declared Serializable, the serializable state of the object is defined by

serializable fields (by name and type) plus optional data. Optional data can only be

written explicitly by the writeObject method of a Serializable class. Optional

data can be read by the Serializable class’ readObject method or serialization

will skip unread optional data.

When a class is declared Externalizable, the data that is written to the stream by the

class itself defines the serialized state. The class must specify the order, types, and

meaning of each datum that is written to the stream. The class must handle its own

evolution, so that it can continue to read data written by and write data that can be read

by previous versions. The class must coordinate with the superclass when saving and

restoring data. The location of the superclasses data in the stream must be specified.

Chapter 1: System Architecture Page 7

The designer of a Serializable class must ensure that the information saved for the

class is appropriate for persistence and follows the serialization-specified rules for

interoperability and evolution. Class evolution is explained in greater detail in

Chapter 5, “Versioning of Serializable Objects.”

1.7 Accessing Serializable Fields of a Class

Serialization provides two mechanisms for accessing the serializable fields in a stream:

• The default mechanism requires no customization

• The Serializable Fields API allows a class to explicitly access/set the serializable

fields by name and type

The default mechanism is used automatically when reading or writing objects that

implement the Serializable interface and do no further customization. The

serializable fields are mapped to the corresponding fields of the class and values are

either written to the stream from those fields or are read in and assigned respectively.

If the class provides writeObject and readObject methods, the default

mechanism can be invoked by calling defaultWriteObject and

defaultReadObject. When the writeObject and readObject methods are

implemented, the class has an opportunity to modify the serializable field values before

they are written or after they are read.

When the default mechanism cannot be used, the serializable class can use the

putFields method of ObjectOutputStream to put the values for the serializable

fields into the stream. The writeFields method of ObjectOutputStream puts the

values in the correct order, then writes them to the stream using the existing protocol

for serialization. Correspondingly, the readFields method of

ObjectInputStream reads the values from the stream and makes them available to

the class by name in any order. See Section 2.2, “The ObjectOutputStream.PutField

Class” and Section 3.2, “The ObjectInputStream.GetField Class.” for a detailed

description of the Serializable Fields API.

1.8 The ObjectOutput Interface

The ObjectOutput interface provides an abstract, stream-based interface to object

storage. It extends the DataOutput interface so those methods can be used for writing

primitive data types. Objects that implement this interface can be used to store

primitives and objects.

剩余83页未读，继续阅读

weixin_38669628

粉丝: 386
资源: 6万+

Java对象序列化与反序列化详解

序列化和反序列化 Serialization

C++11 下使用 Boost.Serialization 库实现智能指针的序列化

详解Java 序列化与反序列化（Serialization）

Java序列化(Serialization) 机制

序列化(Serialization)实现深拷贝.md

serialization-example:使用瞬态示例进行序列化和反序列化

lora-serialization：The Things Network的LoraWAN序列化反序列化库

Data-Serialization:Xojo 类通过 JSON 序列化和反序列化类

JKI-JSON-Serialization：适用于LabVIEW的JSON序列化和反序列化库

Serialization:Java中的序列化

最新资源