回首Java——Java序列化机制(Serialization,Deserialization)

Java 序列化简介

序列化的必要性(为什么要序列化)

如何进行序列化

下面具体的举一个例子

/**
* 要序列化的类
*/
public class Person implements Serializable {

/**
* 此字段非常重要,它是通过对原始版本的 Person 类运行 JDK serialver命令计算出的。
*/
private static final long serialVersionUID = 1L;

public Person(String fn, String ln, int a) {
this.firstName = fn;
this.lastName = ln;
this.age = a;
}

private String firstName;
private String lastName;
private int age;
private Person spouse;

// get/set方法...省略

}

/**
* 对Person对象进行S/D
*
*/
public class PersonSerializeToDisk {

private static File file = new File("person.ser");

@Test
public void fosDis() {
Person p1 = new Person("Ted","Neward",35);
Person p2 = new Person("Charlotte","Neward",36);

p1.setSpouse(p2);

if(file.exists()) {
file.delete();
}

/**
* 将对象写进文件
*/

FileOutputStream fos = null;
ObjectOutputStream oos = null;
try {
fos = new FileOutputStream(file);
oos = new ObjectOutputStream(fos);
oos.writeObject(p1);
} catch (Exception e) {
e.printStackTrace();
} finally {
if(oos != null) {
try {
oos.close();
} catch (IOException e) {
e.printStackTrace();
}
}
if(fos != null) {
try {
fos.close();
} catch (IOException e) {
e.printStackTrace();
}
}
}
}

@Test
public void fisDis() {
/**
* 从文件中读取反序列化对象
*/
FileInputStream fis = null;
ObjectInputStream ois = null;
try {
fis = new FileInputStream(file);
ois = new ObjectInputStream(fis);
Person desPerson = (Person)ois.readObject();
System.out.println("desPerson.getFirstName():" + desPerson.getFirstName());
assertEquals(desPerson.getFirstName(),"Ted");
System.out.println("desPerson.getSpouse().getFirstName():" + desPerson.getSpouse().getFirstName());
assertEquals(desPerson.getSpouse().getFirstName(),"Charlotte");
System.out.println("desPerson.getAge():" + desPerson.getAge());

} catch (Exception e) {
e.printStackTrace();
} finally {
if(ois != null) {
try {
ois.close();
} catch (IOException e) {
e.printStackTrace();
}
}
if(fis != null) {
try {
fis.close();
} catch (IOException e) {
e.printStackTrace();
}
}
}
}
}

Java对象序列化的几件事

序列化允许一定数量的类变种，甚至重构之后也是如此，ObjectInputStream 仍可以很好地将其读出来。

java Object Serialization 规范可以自动管理的关键任务是：
* 将新字段添加到类中
* 将字段从 static 改为非 static
* 将字段从 transient 改为非 transient

取决于所需的向后兼容程度，转换字段形式（从非 static 转换为 static 或从非 transient 转换为 transient）或者删除字段需要额外的消息传递。

----------------------

**重构序列化类**

既然已经知道序列化允许重构，来看看把新字段添加到 Person 类中.下面把性别新增加上了，然后反序列化一下

enum Gender{
MALE,FEMALE
}
public class Person implements Serializable {

/**
* 此字段非常重要,它是通过对原始版本的 Person 类运行 JDK serialver命令计算出的。
*/
private static final long serialVersionUID = 1L;

public Person(String fn, String ln, int a,Gender g) {
this.firstName = fn;
this.lastName = ln;
this.age = a;
this.gender = g;
}

private String firstName;
private String lastName;
private int age;
private Person spouse;
private Gender gender;

//get/set方法 .....

@Test
public void fisDis() {
/**
* 从文件中读取反序列化对象
*/
FileInputStream fis = null;
ObjectInputStream ois = null;
try {
fis = new FileInputStream(file);
ois = new ObjectInputStream(fis);
Person desPerson = (Person)ois.readObject();
System.out.println("desPerson.getFirstName():" + desPerson.getFirstName());
assertEquals(desPerson.getFirstName(),"Ted");
System.out.println("desPerson.getSpouse().getFirstName():" + desPerson.getSpouse().getFirstName());
assertEquals(desPerson.getSpouse().getFirstName(),"Charlotte");
System.out.println("desPerson.getGender():" + desPerson.getGender());

} catch (Exception e) {
e.printStackTrace();
} finally {
if(ois != null) {
try {
ois.close();
} catch (IOException e) {
e.printStackTrace();
}
}
if(fis != null) {
try {
fis.close();
} catch (IOException e) {
e.printStackTrace();
}
}
}
}
}

null

public class Person implements Serializable {

/**
* 此字段非常重要,它是通过对原始（或 V1）版本的 Person 类运行 JDK serialver命令计算出的。
*/
private static final long serialVersionUID = 1L;

public Person(String fn, String ln, int a) {
this.firstName = fn;
this.lastName = ln;
this.age = a;
}

/**
* 加密
*/
private void writeObject(java.io.ObjectOutputStream stream) throws java.io.IOException {
// "Encrypt"/obscure the sensitive data
age = age << 2;
stream.defaultWriteObject();
}

/**
* 解密,当不知道加密方法的时候，则不能解密
*/
private void readObject(java.io.ObjectInputStream stream) throws java.io.IOException, ClassNotFoundException {
stream.defaultReadObject();
// "Decrypt"/de-obscure the sensitive data
age = age >> 2;
}

private String firstName;
private String lastName;
private int age;
private Person spouse;

// get/set方法
}

public class Person implements Serializable {

/**
* 此字段非常重要,它是通过对原始（或 V1）版本的 Person 类运行 JDK serialver命令计算出的。
*/
private static final long serialVersionUID = 1L;

private String firstName;
private String lastName;
private int age;
private Person spouse;
private transient double salary;

public Person(String fn, String ln, int a) {
this.firstName = fn;
this.lastName = ln;
this.age = a;
}

public Person(String fn, String ln, int a,double s) {
this.firstName = fn;
this.lastName = ln;
this.age = a;
this.salary = s;
}

// get/set方法

}

desPerson.getFirstName():Ted

desPerson.getSpouse().getFirstName():Charlotte

desPerson.getAge():35

desPerson.getSalary():0.0

只有salary的结果没有被序列化

private static File file = new File("person.ser");
private static Key _key = null;

@Test
public void fosDis() {
Person p1 = new Person("Ted","Neward",35,500.55);
Person p2 = new Person("Charlotte","Neward",36);

p1.setSpouse(p2);

if(file.exists()) {
file.delete();
}

/**
* 将对象写进文件
*/

FileOutputStream fos = null;
ObjectOutputStream oos = null;
try {
fos = new FileOutputStream(file);
oos = new ObjectOutputStream(fos);

/**
* 加密
*/
KeyGenerator keyGenerator = KeyGenerator.getInstance("DESede");
_key = keyGenerator.generateKey();
Cipher cipher = Cipher.getInstance("DESede");
cipher.init(Cipher.ENCRYPT_MODE, _key);
SealedObject so = new SealedObject(p1,cipher);

oos.writeObject(so);

System.out.println("Serialized - "+ p1.toString());
} catch (Exception e) {
e.printStackTrace();
} finally {
if(oos != null) {
try {
oos.close();
} catch (IOException e) {
e.printStackTrace();
}
}
if(fos != null) {
try {
fos.close();
} catch (IOException e) {
e.printStackTrace();
}
}
}
}

@Test
public void fisDis() {
/**
* 从文件中读取反序列化对象
*/
FileInputStream fis = null;
ObjectInputStream ois = null;
try {
fis = new FileInputStream(file);
ois = new ObjectInputStream(fis);

SealedObject so = (SealedObject)ois.readObject();
Person person = (Person)so.getObject(_key);//获得解密的key
System.out.println("Deserialized - "+ person.toString());

} catch (Exception e) {
e.printStackTrace();
} finally {
if(ois != null) {
try {
ois.close();
} catch (IOException e) {
e.printStackTrace();
}
}
if(fis != null) {
try {
fis.close();
} catch (IOException e) {
e.printStackTrace();
}
}
}
}

public static void main(String[] args) {
PersonSerializeToDisk pst = new PersonSerializeToDisk();
pst.fosDis();
pst.fisDis();
}

public class Person implements Serializable {

/**
* 此字段非常重要,它是通过对原始（或 V1）版本的 Person 类运行 JDK serialver命令计算出的。
*/
private static final long serialVersionUID = 1L;

public Person(String fn, String ln, int a) {
this.firstName = fn;
this.lastName = ln;
this.age = a;
}

private Object writeReplace() throws java.io.ObjectStreamException {
return new PersonProxy(this);
}
}

public class PersonProxy implements Serializable {

private static final long serialVersionUID = 1L;

public String data;

public PersonProxy(Person orig) {
data = orig.getFirstName() + "," + orig.getLastName() + "," + orig.getAge();
if (orig.getSpouse() != null) {
Person spouse = orig.getSpouse();
data = data + "," + spouse.getFirstName() + "," + spouse.getLastName() + "," + spouse.getAge();
}
}

private Object readResolve() throws java.io.ObjectStreamException {
String[] pieces = data.split(",");
Person result = new Person(pieces[0], pieces[1], Integer.parseInt(pieces[2]));
if (pieces.length > 3) {
result.setSpouse(new Person(pieces[3], pieces[4], Integer.parseInt(pieces[5])));
result.getSpouse().setSpouse(result);
}
return result;
}

}

public class Person implements Serializable, ObjectInputValidation {

/**
* 此字段非常重要,它是通过对原始（或 V1）版本的 Person 类运行 JDK serialver命令计算出的。
*/
private static final long serialVersionUID = 1L;

private String firstName;
private String lastName;
private int age;
private Person spouse;
private double salary;

public Person(String fn, String ln, int a) {
this.firstName = fn;
this.lastName = ln;
this.age = a;
}

public Person(String fn, String ln, int a, double s) {
this.firstName = fn;
this.lastName = ln;
this.age = a;
this.salary = s;
}

private void readObject(java.io.ObjectInputStream stream) throws java.io.IOException, ClassNotFoundException {
stream.defaultReadObject();
stream.registerValidation(this, 0);
System.out.println("Customized readObject method called.");
}

@Override
public void validateObject() throws InvalidObjectException {
System.out.println("Validation object after deserialization.");
if (salary < 0) {
throw new InvalidObjectException("The Deserialized object is invalid. Salary can't be negative.");
} else {
System.out.println("The Deserialized object is valid.");
}
}

//get/set方法 ......
}

这样，如果正确执行，就会进行相应的检查，并是否抛出异常。

private void writeObject(java.io.ObjectOutputStream stream)  throws java.io.IOException  {
throw new NotSerializableException("This class is not serializable");
}

private void readObject(java.io.ObjectInputStream stream)  throws java.io.IOException, ClassNotFoundException  {
throw new NotSerializableException("This class is not serializable");
}

最后

readObject()

writeObject()