🏷 Serialization
2 patterns
Topic: Serialization
All Java patterns related to Serialization — java.evolved
I/O
Deserialization filters
Old
// Dangerous: accepts any class
ObjectInputStream ois =
new ObjectInputStream(input);
Object obj = ois.readObject();
// deserialization attacks possible!
Modern
ObjectInputFilter filter =
ObjectInputFilter.Config
.createFilter(
"com.myapp.*;!*"
);
ois.setObjectInputFilter(filter);
Object obj = ois.readObject();
hover to see modern →
JDK 9+
learn more →
Security
Standard Base64 encoding and decoding
Old
String encoded = new sun.misc.BASE64Encoder()
.encode(data);
Modern
String encoded = Base64.getEncoder()
.encodeToString(data);
hover to see modern →
JDK 8+
learn more →