Java IO.pdf - Nguyen Dang Binh

Java I/O
array output stream, a hacker can convert an object into a byte array. The byte array can be
manipulated and modified without any access protection or security manager checks. Then the
byte array can be reconstituted into a Java object by using it as the source of a byte array input
stream.
Security isn't the only potential problem. Some objects exist only as long as the current
program is running. A java.net.Socket object represents an active connection to a remote
host. Suppose a socket is serialized to a file, and the program exits. Later the socket is
deserialized from the file in a new program—but the connection it represents no longer exists.
Similar problems arise with file descriptors, I/O streams, and many more classes.
For these and other reasons, Java does not allow instances of arbitrary classes to be serialized.
You can only serialize instances of classes that implement the java.io.Serializable
interface. By implementing this interface, a class indicates that it may be serialized without
undue problems.
public interface Serializable
This interface does not declare any methods or fields; it serves purely to indicate that a class
may be serialized. You should recall, however, that subclasses of a class that implements a
particular interface also implement that interface by inheritance. Thus, many classes that do
not explicitly declare that they implement Serializable are in fact serializable. For instance,
java.awt.Component implements Serializable. Therefore, its direct and indirect
subclasses, including Button, Scrollbar, TextArea, List, Container, Panel,
java.applet.Applet, all subclasses of Applet, and all Swing components may be
serialized. java.lang.Throwable implements Serializable. Therefore, all exceptions and
errors are serializable.
Table 11.1 lists the classes in the Java 2 core API that directly implement Serializable.
Instances of these classes or their subclasses are serializable. Many packages not listed here
do contain serializable classes. However, these are only serializable because their superclasses
in another package are serializable. For example, java.applet.Applet is serializable
because java.awt.Component is serializable. Some of the unfamiliar names in Table 11.1 are
inner classes you don't normally see, like java.text.UnicodeClassMapping. Inner classes
are only serializable if they are declared to implement Serializable. That their outer class
implements Serializable is not enough to make the inner class serializable.
Package
Table 11.1. Serializable Classes in the java Packages
Serializable
BorderLayout, CardLayout, CheckboxGroup, Color,
Component, ComponentOrientation, Cursor,
Dimension, Event, FlowLayout, FocusManager, Font,
java.awt
FontMetrics,
GridBagConstraints,
GraphicsConfigTemplate,
GridBagLayout,
GridBagLayoutInfo, GridLayout, ImageMediaEntry,
Insets, LightweightDispatcher, MediaTracker,
java.awt.dnd
MenuComponent, MenuShortcut, Point, Polygon,
Rectangle, ScrollPaneAdjustable, SystemColor
DropTarget
java.awt.font TransformAttribute
java.awt.geom AffineTransform
242