fjy8018/Design-pattern
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

序列化攻击补充

Browse Source
This commit is contained in:
F嘉阳
2018-09-24 16:33:46 +08:00
parent 8aacfe3ed9
commit b507f4e478
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/main/java/top/fjy8018/designpattern/pattern/creational/singleton/HungrySingleton.java
View File

@@ -1,5 +1,7 @@
package top.fjy8018.designpattern.pattern.creational.singleton;
import lombok.extern.slf4j.Slf4j;
import java.io.Serializable;
/**
@@ -10,6 +12,7 @@ import java.io.Serializable;
* @author F嘉阳
* @date 2018-09-24 15:38
*/
@Slf4j
public class HungrySingleton implements Serializable {
/**
* 类加载时初始化
@@ -18,10 +21,15 @@ public class HungrySingleton implements Serializable {
private static final HungrySingleton HUNGRYSINGLETON;
static {
log.debug(HungrySingleton.class.getSimpleName() + "静态块实例化");
HUNGRYSINGLETON = new HungrySingleton();
}
/**
* 该构造器会在反射攻击时调用
*/
private HungrySingleton() {
log.debug(HungrySingleton.class.getSimpleName() + "构造器实例化");
}
public static HungrySingleton getInstance() {

10
src/main/java/top/fjy8018/designpattern/pattern/creational/singleton/HungrySingletonSerializableImprove.java
View File

@@ -1,5 +1,7 @@
package top.fjy8018.designpattern.pattern.creational.singleton;
import lombok.extern.slf4j.Slf4j;
import java.io.ObjectInputStream;
import java.io.ObjectStreamClass;
import java.io.Serializable;
@@ -13,21 +15,24 @@ import java.io.Serializable;
* 返回true后序列化过程通过反射机制实例化该类
* <p>
* 改进方法：在{@link ObjectInputStream#readOrdinaryObject(boolean)} 2071行会检测内部方法
* 在{@link ObjectStreamClass#hasReadResolveMethod()} 中，判断是否存在名为readResolve的方法，方法名定义在522行
* 若有该方法，则用该方法返回的对象写入
* 在{@link ObjectStreamClass#hasReadResolveMethod()} 中，此时已经实例化了一个新对象，之后判断是否存在名为readResolve的方法，方法名定义在522行
* 若有该方法，则用该方法返回的对象替换之前实例化的新对象
*
* @author F嘉阳
* @date 2018-09-24 15:38
*/
@Slf4j
public class HungrySingletonSerializableImprove implements Serializable {
private static final HungrySingletonSerializableImprove HUNGRYSINGLETON;
static {
log.debug(HungrySingletonSerializableImprove.class.getSimpleName() + "实例化");
HUNGRYSINGLETON = new HungrySingletonSerializableImprove();
}
private HungrySingletonSerializableImprove() {
log.debug(HungrySingletonSerializableImprove.class.getSimpleName() + "实例化");
}
public static HungrySingletonSerializableImprove getInstance() {
@@ -40,6 +45,7 @@ public class HungrySingletonSerializableImprove implements Serializable {
* @return
*/
private Object readResolve() {
log.debug("序列化获取对象");
return HUNGRYSINGLETON;
}