Customize serialization in Java

How do I create my own serialization protocol?

To create your own serialization protocol, it is enough to implement the Externalizable interface, which contains two methods: 

public void writeExternal(ObjectOutput out) throws IOException; 
public void readExternal(ObjectInput in) throws IOException, ClassNotFoundException;

serialVersionUID field in serialization

serialVersionUID is used to indicate the version of the serialized data.

When we don't explicitly declare the serialVersionUID in our class, the Java runtime does it for us, but the process is sensitive to many of the class's metadata, including the number of fields, the type of the fields, the access modifiers of the fields, the interfaces that the class implements, etc.

It is recommended to explicitly declare serialVersionUID since when adding or removing class attributes, the dynamically generated value may change and an InvalidClassException will be thrown at the time of execution.

private static final long serialVersionUID = 20161013L;

The serialVersionUID must be changed when an incompatible change is made to the class, for example when an attribute is removed.

Problem with serializing Singleton

The problem is that after deserialization we will get another object. Thus, serialization makes it possible to create the Singleton again, which is not valid. There are two ways to avoid this:

  • explicit denial of serialization
  • defining a method with signature (default/public/private/protected/) Object readResolve() throws ObjectStreamException, whose purpose is to return a replacement object instead of the object on which it was called.

Ways to control the values of a deserialized object

If you need to control the values of the deserialized object, you can use the ObjectInputValidation interface with overriding the validateObject() method.

// If you call the validateObject() method after deserializing the object, 
// an InvalidObjectException exception will be thrown 
// if the age value is outside 39 ... 60.
public class Person implements java.io.Serializable,
                               java.io.ObjectInputValidation {
    ...
    @Override
    public void validateObject() throws InvalidObjectException {
        if ((age < 39) || (age > 60))
            throw new InvalidObjectException("Invalid age");
    }
}

There are also ways of signing and encryption to make sure that the data has not been changed:

  • using the description of the logic in writeObject() and readObject()
  • put in the wrapper class javax.crypto.SealedObject and/or java.security.SignedObject. These classes are serializable, so when you wrap an object in a SealedObject, a kind of "gift wrapping" is created around the original object. For encryption, a symmetric key must be created, which must be managed separately. Likewise, you can use the SignedObject class to validate data, which also requires a separately managed symmetric key.

Read also:


Comments

Post a Comment

Popular posts from this blog

Methods for reading XML in Java

Image
DOM (Document Object Model) - object - reads XML, recreating it in memory in the form of an object structure, while the XML document is represented as a set of tags - nodes. Each node can have an unlimited number of child nodes. Each child can also contain several levels of descendants or none at all. Thus, the result is a kind of tree. Pluses: Easy to program. If there are many objects in XML with cross-references to each other, it is enough to go through the document twice: first time create objects without references and fill in the name-object dictionary, the second time - restore links. If an error occurs in XML, a half-created XML structure remains in memory, which will be automatically destroyed. Suitable for both reading and writing. Minuses: Low speed. Wastes a lot of memory. SAX (Simple API for XML) - event-driven - reads an XML document, responding to emerging events (opening or closing tag, string, attribute) by calling the event handlers provided by the appl...
Read more

XML, well-formed XML and valid XML

Image
XML, the eXtensible Markup Language, is a language with a simple formal syntax, well suited for creating and manipulating documents with programs, and at the same time easy to read and create documents by humans. XML is extensible, it does not fix the markup used in documents, and the developer is free to create markup in accordance with the needs of a particular area, being limited only by the syntax rules of the language. DTD A DTD, Document Type Definition, is a predefined set of rules that defines the relationships between elements and attributes. For example, the DTD for HTML says that the DIV tag must be inside the BODY tag and can appear multiple times, TITLE - in HEAD and only once, and SCRIPT - both there and there as many times as you want. A DTD is usually described directly in the document as a formulation line starting with <!DOCTYPE ... > or in a separate file. Difference between well-formed XML and valid XML Depending on the level of compliance, the document...
Read more

ArrayList and LinkedList in Java, memory usage and speed

Image
How much extra memory is needed when calling ArrayList.add()? If there is enough space in the array to accommodate a new element, then no additional memory is required. Otherwise, a new array is created, 1.5 times larger than the existing one (this is true for JDK above 1.7, in earlier versions the size of the increase is different). How much extra memory is allocated when you call LinkedList.add()? One new instance of the nested Node class is created. How much memory to store one byte primitive in LinkedList? Each LinkedList element stores a link to the previous element, the next element, and a data link. private static class Node<E> { E item; Node<E> next; Node<E> prev; //... } For 32-bit systems, each link is 32 bits (4 bytes). The object (header) of the nested Node class itself takes 8 bytes. 4 + 4 + 4 + 8 = 20 bytes, and since the size of each object in Java is a multiple of 8, so we get 24 bytes. A byte primitive occupies 1 by...
Read more