Java IO.pdf - Nguyen Dang Binh

Java I/O
3. Serializing it is a potential security risk (java.lang.SecurityManager,
java.security.MessageDigest).
4. The class is mostly a holder for static methods without any real internal state
(java.beans.Beans, java.lang.Math).
5. The person who wrote the class simply didn't think about serialization.
11.5.1 Classes That Implement Serializable but Aren't
Just because a class may be serialized does not mean that it can be serialized. Several
problems can prevent a class that implements Serializable from actually being serialized.
Attempting to serialize such a class throws a NotSerializableException, a kind of
IOException:
public class NotSerializableException extends ObjectStreamException
11.5.1.1 Problem 1: References to nonserializable objects
The first common problem that prevents a serializable class from being serialized is that its
graph contains objects that do not implement Serializable. The graph of an object is the
collection of all objects that the object holds references to, and all the objects those objects
hold references to, and all the objects those objects hold references to, and so on, until there
are no more connected objects that haven't appeared in the collection. For an object to be
serialized, all the objects it holds references to must also be serializable, and all the objects
they hold references to must be serializable, and so on. For instance, consider this skeleton of
a class:
import java.applet.*;
import java.net.*;
public class MyNetworkingApplet extends Applet {
}
Socket theConnection;
//...
MyNetworkingApplet extends Applet, which extends Panel, which extends Container,
which extends Component, which implements Serializable. Thus, MyNetworkingApplet
should be serializable. However, MyNetworkingApplet contains a reference to a
java.net.Socket object. Socket is not a serializable class. Therefore, if you try to pass a
MyNetworkingApplet instance to writeObject(), a NotSerializableException will be
thrown.
The situation is even worse for container classes like Hashtable and Vector. Since
serialization performs a deep copy to the output stream, storing even a single nonserializable
class inside a vector or hash table prevents it from being serialized. Since the objects stored in
a container can vary from program to program or run to run, there's no sure-fire way to know
whether or not a particular instance of a container class can be serialized, short of trying it.
The same problem commonly occurs in applets and other GUI programs that use a Container
to hold many different components connected by events. If any of the objects in the container
244