Serialization Flatten your object for automated storage or

Serialization Flatten your object for automated storage or network transfer Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 1

Software object persistence • Persistence: Saving information about an object to recreate at different time, or place or both. • Object serialization means of implementing persistence: convert object’s state into byte stream to be used later to reconstruct (build-deserialized) a virtually identical copy of original object. • Default serialization for an object writes: – the class of the object, – the class signature, – values of all non-transient and non-static fields. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 2

Serialization protocol • For serialization: – java. io. Object. Output. Stream via write. Object which calls on default. Write. Object, • For deserialization: – java. io. Object. Input. Stream via read. Object which calls on default. Read. Object. • Any object instance that belongs to the graph of the object being serialized must be serializable as well. • Superclass must be Serializable. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 3

Serialization protocol • Customize default: implement extended versions of default methods in: – write. Object – read. Object – But final fields cannot be read with read. Object. Need to use default. • Create own complete serialization by implementing the interface Externalizable. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 4

Specifying persistent objects • Class of the object to be serializable must implement interface: java. io. Serializable • This interface is an empty interface and is used to mark the objects of such class as persistent. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 5

Deserialization • It reads values written during serialization • Static fields in the class are left untouched. – If class needs to be loaded, then normal initialization of the class takes place, giving static fields its initial values. • Transient fields will be initialized to default values • Recreation of the object graph will occur in reverse order from its serialization. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 6

Example import public java. io. Serializable; java. util. Date; java. util. Calendar; class Persistent. Time implements Serializable { public Persistent. Time() { time = Calendar. get. Instance(). get. Time(); } public Date get. Time() { return time; } private Date time; } Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 7

Class java. io. Object. Output. Stream • An Object. Output. Stream instance writes primitive data types and graphs of Java objects to an Output. Stream. The objects can be read (reconstituted) using an Object. Input. Stream. Persistent storage of objects can be accomplished by using a file for the stream. If the stream is a network socket stream, the objects can be reconstituted on another host or in another process. • Only objects that support the java. io. Serializable interface can be written to streams. The class of each serializable object is encoded including the class name and signature of the class, the values of the object's fields and arrays, and the closure of any other objects referenced from the initial objects. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 8

Class java. io. Object. Output. Stream • The method write. Object is used to write an object to the stream. Any object, including Strings and arrays, is written with write. Object. Multiple objects or primitives can be written to the stream. The objects must be read back from the corresponding Object. Inputstream with the same types and in the same order as they were written. • Primitive data types can also be written to the stream using the appropriate methods from Data. Output. Strings can also be written using the write. UTF method. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 9

Example import java. io. Object. Output. Stream; import java. io. File. Output. Stream; import java. io. IOException; public class Flatten. Time{ public static void main(String [] args){ String filename = "time. ser"; if(args. length > 0){ filename = args[0]; } Persistent. Time time = new Persistent. Time(); File. Output. Stream fos = null; Object. Output. Stream out = null; try{ fos = new File. Output. Stream(filename); out = new Object. Output. Stream(fos); out. write. Object(time); out. close(); } catch(IOException ex){ ex. print. Stack. Trace(); } } } Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 10

import java. io. Object. Input. Stream; import java. io. File. Input. Stream; import java. io. IOException; import java. util. Calendar; public class Inflate. Time{ public static void main(String [] args){ String filename = "time. ser"; if(args. length > 0){ filename = args[0]; } Persistent. Time time = null; File. Input. Stream fis = null; Object. Input. Stream in = null; try{ fis = new File. Input. Stream(filename); in = new Object. Input. Stream(fis); time = (Persistent. Time)in. read. Object(); in. close(); } catch(IOException ex){ ex. print. Stack. Trace(); } catch(Class. Not. Found. Exception ex){ ex. print. Stack. Trace(); } System. out. println("Flattened time: " + time. get. Time()); System. out. println("Current time: " + Calendar. get. Instance(). get. Time()); } } Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 11

Serializable vs. Non-Serializable objects • Java. lang. Object does not implement serializable, so you must decide which of your classes need to implement it. • AWT, Swing components, strings, arrays are defined serializable. • Certain classes and subclasses are not serializable: Thread, Output. Stream, Socket • When a serializable class contains instance variables which are not or should not be serializable they should be marked as that with the keyword transient. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 12

Transient fields • These fields will not be serialized. • When deserialized, these fields will be initialized to default values – Null for object references – Zero for numeric primitives – False for boolean fields • If these values are unacceptable – Provide a read. Object() that invokes default. Read. Object() and then restores transient fields to their acceptable values. – Or, the fields can be initialized when used for the first time. (Lazy initialization. ) Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 13

Serial version UID • You should explicitly declare a serial version UID in every serializable class. – Eliminates serial version UID as a potential source of incompatibility. – Small performance benefit, as Java does not have to come up with this unique number. – private static final long serial. Version. UID =rlv; – rlv can be any number out thin air, but must be unique for each serializable class in your development. – If you want to make a new version of the class incompatible with existing version, choose a different UID. Deserialization of previous version will fail with Invalid. Class. Exception. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 14

Customizing Output. Object. Stream, Input. Object. Stream • To provide special behavior in the writing or reading of stream object bytes implement private void write. Object(Object. Output. Stream out) throws IOException; private void read. Object(Object. Input. Stream in) throws IOException, Class. Not. Found. Exception; Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 15

Creating your own protocol: Externalizable • Instead of implementing the Serializable interface, implement Externalizable: interface Externalizable{ public void write. External(Object. Output out) throws IOException; public void read. External(Object. Input in) throws IOException; } Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 16

Performance • Serialization is a very expensive process. You must clearly have reasons to serialize instead of you directly writing what you need to save about the state of an object. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 17

Default or Customized serialization? Or Implementing Serializable judiciously • Allowing a class’s instances to be serializable can be as simple as adding the words “implements Serializable” to the class specification. • This is a common misconception, the truth is far more complex. • While efficiency it is one cost associated with it, there are other long-term costs that are much more substantial. • Using default serialization is very easy but this a very specious Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 18

Serialization Costs • Your object’s private structure is out for the viewing!!!! It’s become part of the API. • A major cost is that it decreases flexibility to change a class’s implementation once the class has been release • Increases the likelihood of bugs and security holes. • Increases the testing associated with releasing a new version of the class. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 19

Serialization caveats • Implementing Serializable is not a decision to be undertaken lightly. • Classes design for inheritance should rarely implement serializable and interfaces should rarely extend it. – You should provide parameterless constructor on nonserializable classes designed for inheritance, in case it is subclassed and the subclass wants to provide serialization. • Inner classes should rarely if ever, implement Serializable. • A static member class can be serializable. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 20

Consider using a custom serialized form • The default serialized form of an object is an encoding of the physical representation of the object graph rooted at the object – Data contained in every object reachable from it. – Topology by which all of these objects are interlinked. • The ideal serialized form contains only the logical data represented by the object. It is independent of its physical representation. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 21

Consider using a custom serialized form • Default serialization is likely to be appropriate if an object’s physical presentation is identical to its logical content. – Appropriate: A Name class. – Not appropriate: A doubly linked List class. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 22

Consider using a custom serialized form • Disadvantages of default serialization when physical and logical representation differ: – Permanently ties the exported API to the internal representation. – Can consume excessive space. – Can consume excessive time. – Can cause stack overflow. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 23

Consider using a custom serialized form • A reasonable serialized form for a List is the number of entries followed by each of the entries. • Although default serialized form is correct for a List case, it may not be the case for any object whose invariants are tied to implementationspecific details. – Example: a hash table using buckets. This is based on the hash code of the key, which may change from JVM to JVM, or for different runs of the hash table in same JVM. Thus default serialized form can violate the invariant for hash tables in this case. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 24

read. Object() and security attacks • Deserialization uses default. Read. Object() and read. Object() to create a new instance of a class. • Thus read. Object is a constructor!!!!! • So, read. Object must behave like any other constructor: – Check for argument’s validity if need be – Make copies of parameters where needed • Otherwise, a very simple job for an attacker to violate object’s invariants. – Provide a hand-made serialization of the attack object. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 25

Guide for writing a bulletproof read. Object • Private reference fields should be initialized with copies of its values. • Check invariants and throw an Invalid. Object. Exception if they fail. • As with constructors, do not invoke any overridable methods. • If an entire object graph must be check for validity after deserialization, the object. Input. Validation interface should be used. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 26

write. Replace() • Sometimes it may not be appropriate to serialize the actual object, but some specifically given object. <access> Object write. Replace() throws Object. Stream. Exception; Returns an object that will replace the current object during serialization. Any object may be returned including the current one. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 27

A comment about access qualifier • These methods can be of any accessibility • They will be used if they are accessible to the object type being serialized – If a class has private read. Resolve, it only affects serialization of objects that are exactly its type. – If package-accessible read. Resolve affects only subclasses within the same package – public and protected read. Resolve affect objects of all subclasses. Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 28

read. Resolve() • Recall that deserialization produces an instance of a class object. • If a given class should only have one instance (singleton pattern), then via deserialization we can provide a different instance!!! • In general you need to be concerned of what is being created for instance-controlled classes. • Enter: read. Resolve(); this is a method that returns the appropriate instance of the class at hand by the read. Object() or default. Read. Object() methods. <access> read. Resolve() throws Object. Stream. Exception; Spring/2002 Distributed Software Engineering C: unocourses4350slidesDefining. Threads 29