Java ObjectInputStream类代码示例

import java.io.ObjectInputStream; //导入依赖的package包/类
/**
 * <p>
 * This method should be overridden by any delegate subclasses that need
 * special handling for BLOBs. The default implementation uses standard
 * JDBC <code>java.sql.Blob</code> operations.
 * </p>
 * 
 * @param rs
 *          the result set, already queued to the correct row
 * @param colName
 *          the column name for the BLOB
 * @return the deserialized Object from the ResultSet BLOB
 * @throws ClassNotFoundException
 *           if a class found during deserialization cannot be found
 * @throws IOException
 *           if deserialization causes an error
 */
protected Object getObjectFromBlob(ResultSet rs, String colName)
    throws ClassNotFoundException, IOException, SQLException {
    
    Object obj = null;

    Blob blobLocator = rs.getBlob(colName);
    InputStream binaryInput = null;
    try {
        if (null != blobLocator && blobLocator.length() > 0) {
            binaryInput = blobLocator.getBinaryStream();
        }
    } catch (Exception ignore) {
    }

    if (null != binaryInput) {
        ObjectInputStream in = new ObjectInputStream(binaryInput);
        try {
            obj = in.readObject();
        } finally {
            in.close();
        }
    }

    return obj;
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
@Override
protected Object getObjectFromBlob(ResultSet rs, String colName)
    throws ClassNotFoundException, IOException, SQLException {
    
    Object obj = null;
    InputStream binaryInput = rs.getBinaryStream(colName);
    if (binaryInput != null) {
        ObjectInputStream in = new ObjectInputStream(binaryInput);
        try {
            obj = in.readObject();
        } finally {
            in.close();
        }
    }

    return obj;
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
private static Object copyObject(Object oldObj) {
    Object newObj = null;
    try {
       //Create a stream in which to serialize the object.
        ByteArrayOutputStream ostream = new ByteArrayOutputStream();
        ObjectOutputStream p = new ObjectOutputStream(ostream);
        //Serialize the object into the stream
        p.writeObject(oldObj);

        //Create an input stream from which to deserialize the object
        byte[] byteArray = ostream.toByteArray();
        ByteArrayInputStream istream = new ByteArrayInputStream(byteArray);
        ObjectInputStream q = new ObjectInputStream(istream);
        //Deserialize the object
        newObj = q.readObject();
    } catch (Exception ex) {
        ex.printStackTrace();
    }
    return newObj;
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
public static Object deserializeObject(byte[] b) {
    try {
        ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(b));
        Object object = in.readObject();
        in.close();

        return object;
    } catch(ClassNotFoundException cnfe) {
        Log.e("deserializeObject", "class not found error", cnfe);

        return null;
    } catch(IOException ioe) {
        Log.e("deserializeObject", "io error", ioe);

        return null;
    }
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
/**
 * Run benchmark for given number of batches, with given number of cycles
 * for each batch.
 */
void doReps(ObjectOutputStream oout, ObjectInputStream oin,
            StreamBuffer sbuf, int[][] arrays, int nbatches)
    throws Exception
{
    int ncycles = arrays.length;
    for (int i = 0; i < nbatches; i++) {
        sbuf.reset();
        oout.reset();
        for (int j = 0; j < ncycles; j++) {
            oout.writeObject(arrays[j]);
        }
        oout.flush();
        for (int j = 0; j < ncycles; j++) {
            oin.readObject();
        }
    }
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
/**
 * Reads the <code>ObjectInputStream</code> and if
 * it isn't <code>null</code> adds a listener to
 * receive adjustment events fired by the
 * <code>Scrollbar</code>.
 * Unrecognized keys or values will be ignored.
 *
 * @param s the <code>ObjectInputStream</code> to read
 * @exception HeadlessException if
 *   <code>GraphicsEnvironment.isHeadless</code> returns
 *   <code>true</code>
 * @see java.awt.GraphicsEnvironment#isHeadless
 * @see #writeObject(ObjectOutputStream)
 */
private void readObject(ObjectInputStream s)
  throws ClassNotFoundException, IOException, HeadlessException
{
  GraphicsEnvironment.checkHeadless();
  s.defaultReadObject();

  Object keyOrNull;
  while(null != (keyOrNull = s.readObject())) {
    String key = ((String)keyOrNull).intern();

    if (adjustmentListenerK == key)
      addAdjustmentListener((AdjustmentListener)(s.readObject()));

    else // skip value for unrecognized key
      s.readObject();
  }
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
/**
 * Controls the way the CommunicatorServer service is deserialized.
 */
private void readObject(ObjectInputStream stream)
    throws IOException, ClassNotFoundException {

    // Call the default deserialization of the object.
    //
    stream.defaultReadObject();

    // Call the specific initialization for the CommunicatorServer service.
    // This is for transient structures to be initialized to specific
    // default values.
    //
    stateLock = new Object();
    state = OFFLINE;
    stopRequested = false;
    servedClientCount = 0;
    clientHandlerVector = new Vector<>();
    mainThread = null;
    notifCount = 0;
    notifInfos = null;
    notifBroadcaster = new NotificationBroadcasterSupport();
    dbgTag = makeDebugTag();
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
/**
 * 
 * 功能描述:自己数组转换成对象 <br>
 * 〈功能详细描述〉
 *
 * @param bytes bytes
 * @return object
 * @throws IOException ioexception
 * @see [相关类/方法](可选)
 * @since [产品/模块版本](可选)
 */
public static Object byteArrayToObject(byte[] bytes) throws IOException {
    if (bytes == null || bytes.length <= 0) {
        return null;
    }
    Object obj = null;
    try {
        ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
        ObjectInputStream ois = new ObjectInputStream(new BufferedInputStream(bis));
        obj = ois.readObject();
        bis.close();
        ois.close();
    } catch (ClassNotFoundException e) {
        logger.error(e.getMessage());
    }
    return obj;
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
public static void main( String[] args ) throws IOException, ClassNotFoundException
{
    Person obj = new Person();
    obj.setName( "Robin" );
           
    PersonHack objH = new PersonHack();
      
    ByteArrayOutputStream baos = new ByteArrayOutputStream();
    ObjectOutputStream oos = new ObjectOutputStream(baos);
    oos.writeObject(objH);
    
    //反序列化漏洞，如果反序列化的對象可以試任意的，則有可能執行任意有風險額代碼
    ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());
    ObjectInputStream  ois = new ObjectInputStream(bais);
    
    Person objCopy = (Person)ois.readObject();        
    System.out.println(objCopy.getName());

}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
private void readObject(ObjectInputStream in)
    throws IOException, ClassNotFoundException
{
    // Don't call in.defaultReadObject()

    // Read in serialized fields
    ObjectInputStream.GetField gfields = in.readFields();

    // Get the one we want
    @SuppressWarnings("unchecked")
    Vector<SocketPermission> permissions = (Vector<SocketPermission>)gfields.get("permissions", null);
    perms = new ConcurrentSkipListMap<>(new SPCComparator());
    for (SocketPermission sp : permissions) {
        perms.put(sp.getName(), sp);
    }
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
/**
 * Write and read char arrays to/from a stream.  The benchmark is run in
 * batches, with each batch consisting of a fixed number of read/write
 * cycles.  The ObjectOutputStream is reset after each batch of cycles has
 * completed.
 * Arguments: <array size> <# batches> <# cycles per batch>
 */
public long run(String[] args) throws Exception {
    int size = Integer.parseInt(args[0]);
    int nbatches = Integer.parseInt(args[1]);
    int ncycles = Integer.parseInt(args[2]);
    char[][] arrays = new char[ncycles][size];
    StreamBuffer sbuf = new StreamBuffer();
    ObjectOutputStream oout =
        new ObjectOutputStream(sbuf.getOutputStream());
    ObjectInputStream oin =
        new ObjectInputStream(sbuf.getInputStream());

    doReps(oout, oin, sbuf, arrays, 1);     // warmup

    long start = System.currentTimeMillis();
    doReps(oout, oin, sbuf, arrays, nbatches);
    return System.currentTimeMillis() - start;
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
private void readObject(ObjectInputStream in)
    throws IOException, ClassNotFoundException
{
    in.defaultReadObject();

    /*
     * Verify right at unmarshalling time that this exception instance
     * contains no stack trace data from the server (regardless of whether
     * or not it would be apparent at the RMI client application level).
     */
    StackTraceElement[] trace = getStackTrace();
    if (trace.length > 0) {
        throw new RuntimeException(
            "TEST FAILED: exception contained non-empty stack trace: " +
            Arrays.asList(trace));
    }
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
/**
 * Run benchmark for given number of batches, with given number of cycles
 * for each batch.
 */
void doReps(ObjectOutputStream oout, ObjectInputStream oin,
            StreamBuffer sbuf, int nbatches, int ncycles)
    throws Exception
{
    for (int i = 0; i < nbatches; i++) {
        sbuf.reset();
        for (int j = 0; j < ncycles; j++) {
            oout.writeLong(0);
        }
        oout.flush();
        for (int j = 0; j < ncycles; j++) {
            oin.readLong();
        }
    }
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
/** Read object.
*/
private void readObject(ObjectInputStream ois)
throws IOException, ClassNotFoundException {
    ois.defaultReadObject();

    if (clazz == null) {
        // Means that the class is no longer available in the restoring classloader.
        // Normal enough if the module has been uninstalled etc. #15654
        if (name != null) {
            throw new ClassNotFoundException(name);
        } else {
            // Compatibility with older WR's.
            throw new ClassNotFoundException();
        }
    }

    object = findObject(clazz, true);
    object.inReadExternal = true;

    try {
        object.readExternal(ois);
    } finally {
        object.inReadExternal = false;
    }
}
 

import java.io.ObjectInputStream; //导入依赖的package包/类
/**
 * Write and read double values to/from a stream.  The benchmark is run in
 * batches: each "batch" consists of a fixed number of read/write cycles,
 * and the stream is flushed (and underlying stream buffer cleared) in
 * between each batch.
 * Arguments: <# batches> <# cycles per batch>
 */
public long run(String[] args) throws Exception {
    int nbatches = Integer.parseInt(args[0]);
    int ncycles = Integer.parseInt(args[1]);
    StreamBuffer sbuf = new StreamBuffer();
    ObjectOutputStream oout =
        new ObjectOutputStream(sbuf.getOutputStream());
    ObjectInputStream oin =
        new ObjectInputStream(sbuf.getInputStream());

    doReps(oout, oin, sbuf, 1, ncycles);    // warmup

    long start = System.currentTimeMillis();
    doReps(oout, oin, sbuf, nbatches, ncycles);
    return System.currentTimeMillis() - start;
}