Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Classes that require special handling during object serialization and deserialization must implement special methods with exactly the following signatures [API 2006]:

Code Block
private void writeObject(java.io.ObjectOutputStream out) 
    throws IOException;
private void readObject(java.io.ObjectInputStream in)
    throws IOException, ClassNotFoundException;
private void readObjectNoData() throws ObjectStreamException;

Note that these methods must be declared private for any serializable class. Serializable classes may also implement the readResolve() and writeReplace() methods.
According to the Serialization Specification [Sun 2006], readResolve() and writeReplace() method documentation:

...

MITRE CWE

CWE-502. Deserialization of untrusted data

Bibliography

[API 2006]

Serializable

[Sun 2006]

Serialization Specification

[Ware 2008]

 

 

...