序列化和反序列化的对单例破坏的防止及其原理

时间 2019-12-06

标签序列破坏防止及其原理繁體版

原文原文链接

首先咱们来看一下序列化和反序列化是怎么破坏单例的。看代码java

public class HungrySingleton implements Serializable{

    private final static HungrySingleton hungrySingleton;

    static{
        hungrySingleton = new HungrySingleton();
    }
    private HungrySingleton(){
        if(hungrySingleton != null){
            throw new RuntimeException("单例构造器禁止反射调用");
        }
    }
    public static HungrySingleton getInstance(){
        return hungrySingleton;
    }
}
复制代码

这里咱们使用以前的饿汉式的单例做为例子。在以前饿汉式的代码上作点小改动。就是让咱们的单例类实现 Serializable接口。而后咱们在测试类中测试一下怎么破坏。app

public class SingletonTest {
    public static void main(String[] args) throws IOException, ClassNotFoundException {
        HungrySingleton instance = HungrySingleton.getInstance();

        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("singleton_file"));
        oos.writeObject(instance);

        File file = new File("singleton_file");
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(file));
        HungrySingleton newInstance = (HungrySingleton) ois.readObject();

        System.out.println(instance == newInstance;
        
    }
    
}
复制代码

这里首先咱们使用正常的方式来获取一个对象。经过序列化将对象写入文件中，而后咱们经过反序列化的到一个对象，咱们再对比这个对象，输出的内存地址和布尔结果都表示这不是同一个对象。也就说咱们经过使用序列化和反序列化破坏了这个单例，那咱们该如何防治呢？防治起来很简单，只须要在单例类中添加一个readResolve方法，下面看代码：dom

public class HungrySingleton implements Serializable,Cloneable{

    private final static HungrySingleton hungrySingleton;

    static{
        hungrySingleton = new HungrySingleton();
    }
    public static HungrySingleton getInstance(){
        return hungrySingleton;
    }

    private Object readResolve(){
        return hungrySingleton;
    }
}
复制代码

此时咱们再经过测试类进行测试便可发现咱们经过序列化和反序列化获得的仍是同一个对象。那么为何添加一个这个方法就能够防止呢？下咱们跟进去看看为何ide

首先这个readResolve方法不是object里面的方法。咱们进咱们的测试类中去看看这行中的HungrySingleton newInstance = (HungrySingleton) ois.readObject()中的 readObject()的实现。咱们只把关键代码贴出来。函数

public final Object readObject() throws IOException, ClassNotFoundException {
        if (enableOverride) {
            return readObjectOverride();
        }

        // if nested read, passHandle contains handle of enclosing object
        int outerHandle = passHandle;
        try {
            Object obj = readObject0(false);
            handles.markDependency(outerHandle, passHandle);
            ClassNotFoundException ex = handles.lookupException(passHandle);
            if (ex != null) {
                throw ex;
            }
            if (depth == 0) {
                vlist.doCallbacks();
            }
            return obj;
复制代码

咱们重点来看一下 Object obj = readObject0(false)这一行这里调用了一个readObject0方法，咱们再深刻看一下这个readObject0方法的实现。测试

/** * Underlying readObject implementation. */
    private Object readObject0(boolean unshared) throws IOException {
  
    ....  
    
    //各类判断逻辑咱们暂时无论
    
    switch (tc) {
                 switch (tc) {
                case TC_NULL:
                    return readNull();

                case TC_REFERENCE:
                    return readHandle(unshared);

                case TC_CLASS:
                    return readClass(unshared);

                case TC_CLASSDESC:
                case TC_PROXYCLASSDESC:
                    return readClassDesc(unshared);

                case TC_STRING:
                case TC_LONGSTRING:
                    return checkResolve(readString(unshared));

                case TC_ARRAY:
                    return checkResolve(readArray(unshared));

                case TC_ENUM:
                    return checkResolve(readEnum(unshared));

                case TC_OBJECT:
                    return checkResolve(readOrdinaryObject(unshared));

                case TC_EXCEPTION:
                    IOException ex = readFatalException();
                    throw new WriteAbortedException("writing aborted", ex);

                case TC_BLOCKDATA:
                case TC_BLOCKDATALONG:
                 }
            ....     
    
    }
复制代码

咱们看这个 case TC_OBJECT: 也就是判断为object以后的代码，checkResolve(readOrdinaryObject(unshared))这行先是调用了readOrdinaryObject()方法，而后将方法的返回值返回给checkResolve方法，咱们先查看一下readOrdinaryObject()方法。ui

/** * Reads and returns "ordinary" (i.e., not a String, Class, * ObjectStreamClass, array, or enum constant) object, or null if object's * class is unresolvable (in which case a ClassNotFoundException will be * associated with object's handle). Sets passHandle to object's assigned * handle. */
    private Object readOrdinaryObject(boolean unshared){
        
        .....
        //各类判断校验
        
         Object obj;
        try {
            obj = desc.isInstantiable() ? desc.newInstance() : null;
        } catch (Exception ex) {
            throw (IOException) new InvalidClassException(
                desc.forClass().getName(),
                "unable to create instance").initCause(ex);
        }

        passHandle = handles.assign(unshared ? unsharedMarker : obj);
        ClassNotFoundException resolveEx = desc.getResolveException();
        if (resolveEx != null) {
            handles.markException(passHandle, resolveEx);
        }
        
        .....
        
        
            return obj;
    }

复制代码

咱们看一下 obj = desc.isInstantiable() ? desc.newInstance() : null这一行中的obj对象是干吗用的咱们往下翻在这个方法的最后将这个obj返回出去了。咱们又回头看这个这一行obj = desc.isInstantiable() ? desc.newInstance() : null 这个进行判断若是 obj==desc.isInstantiable()就返回一个新的对象，不然返回空，代码看到这里好像有点眉目，我再看看isInstantiable这个方法的实现。this

/** * Returns true if represented class is serializable/externalizable and can * be instantiated by the serialization runtime--i.e., if it is * externalizable and defines a public no-arg constructor, or if it is * non-externalizable and its first non-serializable superclass defines an * accessible no-arg constructor. Otherwise, returns false. */
    boolean isInstantiable() {
        requireInitialized();
        return (cons != null);
    }

复制代码

isInstantiable方法实现很简单，这里的cons是什么呢？咱们继续看spa

/** serialization-appropriate constructor, or null if none */
    private Constructor<?> cons;
复制代码

cons是构造器这里是经过反射获取的对象，光看着一行代码咱们好像并不能看出啥东西，这时候咱们看一下这一行代码的注释。翻译过来的话就是：翻译

若是表示的类是serializable/externalizable而且能够由序列化运行时实例化，则返回true - 若是它是可外部化的而且定义了公共的无参数构造函数，或者它是不可外化的，而且它的第一个非可序列化的超类定义了可访问的无参数构造函数。不然，返回false。

externalizable这个类是serializable的一个子类用于制定序列化，好比自定义某个属性的序列化，用的比较少。好，咱们的单例实现了serializable接口因此这里返回的是true，那么回到咱们以前看看到的那里，也就是这里obj = desc.isInstantiable() ? desc.newInstance() : null 此时返回的就是一个newInstance是经过反射拿到的对象，既然是反射拿到的对象天然是一个新的对象，看到这里咱们算弄明白了为何序列化获取的是一个新的对象。不过到这里仍是没有获得咱们想要的知道的为何写了一个readResolve方法就能够解决反序列化获得的不是同一个对象的问题，那么咱们继续往下看ObjectInputSteam这个类

if (obj != null &&
            handles.lookupException(passHandle) == null &&
            desc.hasReadResolveMethod())
        {
            Object rep = desc.invokeReadResolve(obj);
            if (unshared && rep.getClass().isArray()) {
                rep = cloneArray(rep);
            }
复制代码

看到这里，这里对obj进行了一次空判断，这里咱们刚分析了obj不会为空，看这里desc.hasReadResolveMethod()从命名咱们能够看出这个判断是判断否包含readResolve这个方法。咱们再点进去看看这个的实现

/** * Returns true if represented class is serializable or externalizable and * defines a conformant readResolve method. Otherwise, returns false. */
    boolean hasReadResolveMethod() {
        requireInitialized();
        return (readResolveMethod != null);
    }
复制代码

这里依旧是看代码没啥看的，咱们看看注释，符合咱们的猜想，也就是说这个

if (obj != null &&
            handles.lookupException(passHandle) == null &&
            desc.hasReadResolveMethod())
复制代码

判断结果为true那么咱们再看看这个desc.invokeReadResolve(obj)的实现

/** * Invokes the readResolve method of the represented serializable class and * returns the result. Throws UnsupportedOperationException if this class * descriptor is not associated with a class, or if the class is * non-serializable or does not define readResolve. */
    Object invokeReadResolve(Object obj) throws IOException, UnsupportedOperationException {
        requireInitialized();
        if (readResolveMethod != null) {
            try {
                return readResolveMethod.invoke(obj, (Object[]) null);
            } catch (InvocationTargetException ex) {
                Throwable th = ex.getTargetException();
                if (th instanceof ObjectStreamException) {
                    throw (ObjectStreamException) th;
                } else {
                    throwMiscException(th);
                    throw new InternalError(th);  // never reached
                }
            } catch (IllegalAccessException ex) {
                // should not occur, as access checks have been suppressed
                throw new InternalError(ex);
            }
        } else {
            throw new UnsupportedOperationException();
        }
    }
复制代码

这里咱们看方法名的也能猜想这是使用了反射来调用，看这一行 return readResolveMethod.invoke(obj, (Object[]) null) 使用了反射来调用readResolveMethod方法。但是你可能会问了也没看到用readResolveMethod这个方法啊，我对这个类进行搜索一下 readResolve

/** * Creates local class descriptor representing given class. */
    private ObjectStreamClass(final Class<?> cl) {
    
    .....
    
    
    
   domains = getProtectionDomains(cons, cl);
        writeReplaceMethod = getInheritableMethod(
            cl, "writeReplace", null, Object.class);
        readResolveMethod = getInheritableMethod(
            cl, "readResolve", null, Object.class);
        return null;
    
    ....    
复制代码

在这里能够看到是获取了readResolve这个方法。这样就算解决了咱们最初的疑问了。同窗们能够根据我说的源码在相应的地方打断点看看。