The readObject() method must not call any overridable methods. Invoking overridable methods from the readObject() method can allow provide the overriding method with access to read the object's state of the subclass before it is fully constructed because the base class is deserialized first, followed by the subclass. As a result, readObject() must not call any overridable methods.Also see the related rule initialized. This premature access is possible because, in deserialization, readObject plays the role of object constructor and therefore object initialization is not complete until readObject exits (see also MET06-J. Do not invoke overridable methods in clone()).
Noncompliant Code Example
This noncompliant code example invokes an overridable method from the readObject() method. :
| Code Block | ||
|---|---|---|
| ||
private void readObject(final ObjectInputStream stream) throws throws IOException, ClassNotFoundException { overridableMethod(); stream.defaultReadObject(); } public void overridableMethod() { // ... } |
...
This compliant solution removes the call to the overridable method. When removing such calls is infeasible, ensure that declare the method is declared private or final.
| Code Block | ||
|---|---|---|
| ||
private void readObject(final ObjectInputStream stream) throws throws IOException, ClassNotFoundException { stream.defaultReadObject(); } |
Exceptions
Wiki Markup readObject()}} method may invoke the overridable method {{overridable methods defaultReadObject() and readFields() in class java.io.ObjectInputStream.defaultReadObject()}} \[ [SCG 2009|AA. Bibliography#SCG 09]\].
Risk Assessment
Invoking overridable methods from the readObject() method can lead to initialization errors.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
SER09-J |
Low |
Probable |
Medium | P4 | L3 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.SER09.VREADOBJ | Do not invoke overridable methods from the readObject() method |
Related Guidelines
Guideline 7-4 / OBJECT-4: Prevent constructors from calling methods that can be overridden |
Bibliography
...
[ |
AA. Bibliography#API 06]]
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="370aead3-6d16-4136-824d-27c4c4439663"><ac:plain-text-body><![CDATA[
[[Bloch 2008
AA. Bibliography#Bloch 08]]
Item 17: "Design and document for inheritance or else prohibit it"
]]></ac:plain-text-body></ac:structured-macro>
Item 17, "Design and Document for Inheritance or Else Prohibit It" | |
| [SCG 2009] |
...