Page History

The readObject() method must not call any overridable methods. Invoking overridable methods from the readObject() method can permit provide the overriding method with access to read the object's state of the subclass before it is fully constructed, because the base class is deserialized first, followed by the subclass. Also see the related guideline MET07initialized. This premature access is possible because, in deserialization, readObject plays the role of object constructor and therefore object initialization is not complete until readObject exits (see also MET06-J. Do not invoke overridable methods in clone()).

Noncompliant Code Example

This noncompliant code example invokes an overridable method from the readObject() method. :

private void readObject(final ObjectInputStream stream) throws 

                        throws IOException, ClassNotFoundException {
  overridableMethod(); 
  stream.defaultReadObject();
}

public void overridableMethod() {
  // ...
}

Compliant Solution

This compliant solution removes the call to the overridable method. When removing such calls is infeasible, ensure that declare the overridable method is declared private or final.

private void readObject(final ObjectInputStream stream) throws 

                        throws IOException, ClassNotFoundException {
  stream.defaultReadObject();
}

Exceptions

unmigratedSER09-wiki-markup*SER11-EX1:* "The {{readObject}} methods will often call {{J-EX0: The readObject() method may invoke the overridable methods defaultReadObject() and readFields() in class java.io.ObjectInputStream.defaultReadObject}}, which is an overridable method" \ [[SCG 2009|AA. Bibliography#SCG 09]\]. Such calls are explicitly permitted.

Risk Assessment

Invoking overridable methods from the readObject() method can lead to initialization errors.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[API 2006|AA. Bibliography#API 06]\] 
\[[SCG 2009|AA. Bibliography#SCG 09]\] Guideline 4-4 Prevent constructors from calling methods that can be overridden
\[[Bloch 2008|AA. Bibliography#Bloch 08]\] Item 17: "Design and document for inheritance or else prohibit it"

Automated Detection

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedSER10-J. Do not serialize direct handles to system resources      16. Serialization (SER)      SER12-J. Avoid memory and resource leaks during serialization