16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
73 lines
1.9 KiB
Plaintext
73 lines
1.9 KiB
Plaintext
== Why is this an issue?
|
|
|
|
Writers of ``++Serializable++`` classes can choose to let Java's automatic mechanisms handle serialization and deserialization, or they can choose to handle it themselves by implementing specific methods. However, if the signatures of those methods are not exactly what is expected, they will be ignored and the default serialization mechanisms will kick back in.
|
|
|
|
|
|
=== Noncompliant code example
|
|
|
|
[source,java]
|
|
----
|
|
public class Watermelon implements Serializable {
|
|
// ...
|
|
void writeObject(java.io.ObjectOutputStream out)// Noncompliant; not private
|
|
throws IOException
|
|
{...}
|
|
|
|
private void readObject(java.io.ObjectInputStream in)
|
|
{...}
|
|
|
|
public void readObjectNoData() // Noncompliant; not private
|
|
{...}
|
|
|
|
static Object readResolve() throws ObjectStreamException // Noncompliant; this method may have any access modifier, may not be static
|
|
|
|
Watermelon writeReplace() throws ObjectStreamException // Noncompliant; this method may have any access modifier, but must return Object
|
|
{...}
|
|
}
|
|
----
|
|
|
|
|
|
=== Compliant solution
|
|
|
|
[source,java]
|
|
----
|
|
public class Watermelon implements Serializable {
|
|
// ...
|
|
private void writeObject(java.io.ObjectOutputStream out)
|
|
throws IOException
|
|
{...}
|
|
|
|
private void readObject(java.io.ObjectInputStream in)
|
|
throws IOException, ClassNotFoundException
|
|
{...}
|
|
|
|
private void readObjectNoData()
|
|
throws ObjectStreamException
|
|
{...}
|
|
|
|
protected Object readResolve() throws ObjectStreamException
|
|
{...}
|
|
|
|
private Object writeReplace() throws ObjectStreamException
|
|
{...}
|
|
----
|
|
|
|
|
|
== Resources
|
|
|
|
* https://wiki.sei.cmu.edu/confluence/x/WTdGBQ[CERT, SER01-J.] - Do not deviate from the proper signatures of serialization methods
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* Make "xxx" "private".
|
|
* The "zzz" modifier should not be applied to "xxx".
|
|
|
|
|
|
endif::env-github,rspecator-view[]
|