Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Parasoft Jtest 2021.1

The readObject() method must not call any overridable methods. Invoking overridable methods from the readObject() method can allow provide the overriding method with access to read the object's state of the subclass before it is fully constructed, because the base class is deserialized first, followed by the subclass. As a result, readObject() must not call any overridable methods.Also see the related rule initialized. This premature access is possible because, in deserialization, readObject plays the role of object constructor and therefore object initialization is not complete until readObject exits (see also MET06-J. Do not invoke overridable methods in clone()).

Noncompliant Code Example

This noncompliant code example invokes an overridable method from the readObject() method. :

Code Block
bgColor#FFCCCC

private void readObject(final ObjectInputStream stream) throws 

                        throws IOException, ClassNotFoundException {
  overridableMethod(); 
  stream.defaultReadObject();
}

public void overridableMethod() {
  // ...
}

Compliant Solution

This compliant solution removes the call to the overridable method. When removing such calls is infeasible, ensure that declare the method is declared private or final.

Code Block
bgColor#ccccff

private void readObject(final ObjectInputStream stream) throws 

                        throws IOException, ClassNotFoundException {
  stream.defaultReadObject();
}

Exceptions

unmigratedSER09-wikiJ-markup*SER09-EX0:* The {{readObject()}} method may invoke the overridable method {{overridable methods defaultReadObject() and readFields() in class java.io.ObjectInputStream.defaultReadObject()}} \[ [SCG 2009|AA. Bibliography#SCG 09]\].

Risk Assessment

Invoking overridable methods from the readObject() method can lead to initialization errors.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

SER09-J

low

Low

probable

Probable

medium

Medium

P4

L3

Automated Detection

ToolVersionCheckerDescription
Parasoft Jtest

Include Page
Parasoft_V
Parasoft_V

CERT.SER09.VREADOBJDo not invoke overridable methods from the readObject() method

Related Guidelines

SCG 2009

Secure Coding Guidelines for Java SE, Version 5.0

Guideline 7-4 / OBJECT-4: Prevent constructors from calling methods that can be overridden

Bibliography

...

[

[API

2006

AA. Bibliography#API 06]]

 

]]></ac:plain-text-body></ac:structured-macro>

2014]


[Bloch 2008

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0a5578b8-78a3-4363-bab8-388cce2fe822"><ac:plain-text-body><![CDATA[

[[Bloch 2008

AA. Bibliography#Bloch 08]

]

Item 17

:

, "Design and

document

Document for

inheritance or else prohibit it

Inheritance or Else Prohibit It"

]]></ac:plain-text-body></ac:structured-macro>

[SCG 2009]


...

Image Added Image Added Image Removed      13. Serialization (SER)