Description:
Create A Serialization Class that extend to Non Serialization Class like Below
N:B here must be mention four rules should be there
A> Need to implements Serializable, ObjectInputValidation;
B> private void readObject(ObjectInputStream ois) throws ClassNotFoundException, IOException method
C> private void writeObject(ObjectOutputStream oos) throws IOException mthod
D> public void validateObject() throws InvalidObjectException method
Code 1:
package com.kartik;
/**
*
* @author Kartik Mandal
* Blog kartikchandramandal.blogspot.com
* A non serialization class convert to Serialization class by this algorithm
* @date Feb 25, 2015
*/
public class SuperClass {
private int id;
private String value;
public int getId() {return id;}
public void setId(int id) {this.id = id;}
public String getValue() {return value;}
public void setValue(String value) {this.value = value;}
}
Create A Serialization Class that extend to Non Serialization Class like Below
N:B here must be mention four rules should be there
A> Need to implements Serializable, ObjectInputValidation;
B> private void readObject(ObjectInputStream ois) throws ClassNotFoundException, IOException method
C> private void writeObject(ObjectOutputStream oos) throws IOException mthod
D> public void validateObject() throws InvalidObjectException method
N:B here must be mention four rules should be there
A> Need to implements Serializable, ObjectInputValidation;
B> private void readObject(ObjectInputStream ois) throws ClassNotFoundException, IOException method
C> private void writeObject(ObjectOutputStream oos) throws IOException mthod
D> public void validateObject() throws InvalidObjectException method
package com.kartik;
/**
*
* @author Kartik Mandal
* Blog kartikchandramandal.blogspot.com
* A non serialization class convert to Serialization class by this algorithm
* @date Feb 25, 2015
*/
public class SuperClass {
private int id;
private String value;
public int getId() {return id;}
public void setId(int id) {this.id = id;}
public String getValue() {return value;}
public void setValue(String value) {this.value = value;}
}
/**
*
* @author Kartik Mandal
* Blog kartikchandramandal.blogspot.com
* A non serialization class convert to Serialization class by this algorithm
* @date Feb 25, 2015
*/
public class SuperClass {
private int id;
private String value;
public int getId() {return id;}
public void setId(int id) {this.id = id;}
public String getValue() {return value;}
public void setValue(String value) {this.value = value;}
}
Code 2:
package com.kartik;
import java.io.IOException;
import java.io.InvalidObjectException;
import java.io.ObjectInputStream;
import java.io.ObjectInputValidation;
import java.io.ObjectOutputStream;
import java.io.Serializable;
final public class SubClass extends SuperClass implements Serializable, ObjectInputValidation{
private static final long serialVersionUID = -1322322139926390329L;
private String name;
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
@Override
public String toString(){
return "SubClass{id="+getId()+",value="+getValue()+",name="+getName()+"}";
}
//adding helper method for serialization to save
//initialize super class state
private void readObject(ObjectInputStream ois) throws ClassNotFoundException, IOException{
ois.defaultReadObject();
//notice the order of read and write should be samesetId(ois.readInt());
setValue((String) ois.readObject());
}
private void writeObject(ObjectOutputStream oos) throws IOException{
oos.defaultWriteObject();
oos.writeInt(getId());
oos.writeObject(getValue());
}
@Override
public void validateObject() throws InvalidObjectException {
//validate the object here
if(name == null || "".equals(name)) throw new InvalidObjectException("name can't be null or empty");
if(getId() <=0)
throw new InvalidObjectException("ID can't be negative or zero");
}
}
package com.kartik;
import java.io.IOException;
import java.io.InvalidObjectException;
import java.io.ObjectInputStream;
import java.io.ObjectInputValidation;
import java.io.ObjectOutputStream;
import java.io.Serializable;
final public class SubClass extends SuperClass implements Serializable, ObjectInputValidation{
private static final long serialVersionUID = -1322322139926390329L;
private String name;
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
@Override
public String toString(){
return "SubClass{id="+getId()+",value="+getValue()+",name="+getName()+"}";
}
//adding helper method for serialization to save
//initialize super class state
private void readObject(ObjectInputStream ois) throws ClassNotFoundException, IOException{
ois.defaultReadObject();
//notice the order of read and write should be samesetId(ois.readInt());
setValue((String) ois.readObject());
}
private void writeObject(ObjectOutputStream oos) throws IOException{
oos.defaultWriteObject();
oos.writeInt(getId());
oos.writeObject(getValue());
}
@Override
public void validateObject() throws InvalidObjectException {
//validate the object here
if(name == null || "".equals(name)) throw new InvalidObjectException("name can't be null or empty");
if(getId() <=0)
throw new InvalidObjectException("ID can't be negative or zero");
}
}
Code 3:
package com.kartik;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
/**
* A simple class with generic serialize and deserialize method implementations
* @author Kartik
*
**/
public class SerializationUtil {// deserialize to Object from given file
public static Object deserialize(String fileName) throws IOException,ClassNotFoundException {
FileInputStream fis = new FileInputStream(fileName);
ObjectInputStream ois = new ObjectInputStream(fis);
Object obj = ois.readObject();
ois.close();
return obj;
}
// serialize the given object and save it to file
public static void serialize(Object obj, String fileName)
throws IOException {
FileOutputStream fos = new FileOutputStream(fileName);
ObjectOutputStream oos = new ObjectOutputStream(fos);
oos.writeObject(obj);fos.close();
}
} Step 4> Test That Non Serialization Object now it convert to Serializationpackage com.kartik;import java.io.IOException;public class SerializationTest {public static void main(String[] args) {String fileName="employee.txt";Employee emp = new Employee();emp.setId(100);
emp.setName("kartik");
emp.setSalary(5000);//serialize to filetry {SerializationUtil.serialize(emp, fileName);} catch (IOException e) {
e.printStackTrace();
return;}
Employee empNew = null;
try {
empNew = (Employee) SerializationUtil.deserialize(fileName);
} catch (ClassNotFoundException | IOException e) {
e.printStackTrace();}
System.out.println("emp Object::"+emp);
System.out.println("empNew Object::"+empNew);
}
}
Code 4:
package com.kartik;
import java.io.IOException;
/**
* Test That Non Serialization Object now it convert to Serialization
*
*/
public class SerializationTest {
public static void main(String[] args) {
String fileName="employee.txt";
Employee emp = new Employee();
emp.setId(100);
emp.setName("kartik");
emp.setSalary(5000);//serialize to filetry
{
SerializationUtil.serialize(emp, fileName);
} catch (IOException e) {
e.printStackTrace();
return;
}
Employee empNew = null;
try {
empNew = (Employee) SerializationUtil.deserialize(fileName);
} catch (ClassNotFoundException | IOException e) {
e.printStackTrace();}
System.out.println("emp Object::"+emp);
System.out.println("empNew Object::"+empNew);
}
package com.kartik;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
/**
* A simple class with generic serialize and deserialize method implementations
* @author Kartik
*
**/
public class SerializationUtil {// deserialize to Object from given file
public static Object deserialize(String fileName) throws IOException,ClassNotFoundException {
FileInputStream fis = new FileInputStream(fileName);
ObjectInputStream ois = new ObjectInputStream(fis);
Object obj = ois.readObject();
ois.close();
return obj;
}
// serialize the given object and save it to file
public static void serialize(Object obj, String fileName)
throws IOException {
FileOutputStream fos = new FileOutputStream(fileName);
ObjectOutputStream oos = new ObjectOutputStream(fos);
oos.writeObject(obj);fos.close();
}
} Step 4> Test That Non Serialization Object now it convert to Serializationpackage com.kartik;import java.io.IOException;public class SerializationTest {public static void main(String[] args) {String fileName="employee.txt";Employee emp = new Employee();emp.setId(100);
emp.setName("kartik");
emp.setSalary(5000);//serialize to filetry {SerializationUtil.serialize(emp, fileName);} catch (IOException e) {
e.printStackTrace();
return;}
Employee empNew = null;
try {
empNew = (Employee) SerializationUtil.deserialize(fileName);
} catch (ClassNotFoundException | IOException e) {
e.printStackTrace();}
System.out.println("emp Object::"+emp);
System.out.println("empNew Object::"+empNew);
}
}
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
/**
* A simple class with generic serialize and deserialize method implementations
* @author Kartik
*
**/
public class SerializationUtil {// deserialize to Object from given file
public static Object deserialize(String fileName) throws IOException,ClassNotFoundException {
FileInputStream fis = new FileInputStream(fileName);
ObjectInputStream ois = new ObjectInputStream(fis);
Object obj = ois.readObject();
ois.close();
return obj;
}
// serialize the given object and save it to file
public static void serialize(Object obj, String fileName)
throws IOException {
FileOutputStream fos = new FileOutputStream(fileName);
ObjectOutputStream oos = new ObjectOutputStream(fos);
oos.writeObject(obj);fos.close();
}
} Step 4> Test That Non Serialization Object now it convert to Serializationpackage com.kartik;import java.io.IOException;public class SerializationTest {public static void main(String[] args) {String fileName="employee.txt";Employee emp = new Employee();emp.setId(100);
emp.setName("kartik");
emp.setSalary(5000);//serialize to filetry {SerializationUtil.serialize(emp, fileName);} catch (IOException e) {
e.printStackTrace();
return;}
Employee empNew = null;
try {
empNew = (Employee) SerializationUtil.deserialize(fileName);
} catch (ClassNotFoundException | IOException e) {
e.printStackTrace();}
System.out.println("emp Object::"+emp);
System.out.println("empNew Object::"+empNew);
}
}
package com.kartik;
import java.io.IOException;
/**
* Test That Non Serialization Object now it convert to Serialization
*
*/
public class SerializationTest {
public static void main(String[] args) {
String fileName="employee.txt";
Employee emp = new Employee();
emp.setId(100);
emp.setName("kartik");
emp.setSalary(5000);//serialize to filetry
{
SerializationUtil.serialize(emp, fileName);
} catch (IOException e) {
e.printStackTrace();
return;
}
Employee empNew = null;
try {
empNew = (Employee) SerializationUtil.deserialize(fileName);
} catch (ClassNotFoundException | IOException e) {
e.printStackTrace();}
System.out.println("emp Object::"+emp);
System.out.println("empNew Object::"+empNew);
}
import java.io.IOException;
/**
* Test That Non Serialization Object now it convert to Serialization
*
*/
public class SerializationTest {
public static void main(String[] args) {
String fileName="employee.txt";
Employee emp = new Employee();
emp.setId(100);
emp.setName("kartik");
emp.setSalary(5000);//serialize to filetry
{
SerializationUtil.serialize(emp, fileName);
} catch (IOException e) {
e.printStackTrace();
return;
}
Employee empNew = null;
try {
empNew = (Employee) SerializationUtil.deserialize(fileName);
} catch (ClassNotFoundException | IOException e) {
e.printStackTrace();}
System.out.println("emp Object::"+emp);
System.out.println("empNew Object::"+empNew);
}
OutPut:
emp Object::Employee{name=kartik,id=100,salary=5000}
empNew Object::Employee{name=kartik,id=100,salary=0}
emp Object::Employee{name=kartik,id=100,salary=5000}
empNew Object::Employee{name=kartik,id=100,salary=0}
empNew Object::Employee{name=kartik,id=100,salary=0}
I am Kartik Chandra Mandal from Bangalore, India. Working as software engineer in Java technology. Have good knowledge of OWASP and CSRF in security for applications and it's implementation in Java technology.