Java序列化反序列化原理及漏洞解决方案

public class implements java.io.Serializable{
  public String name;
  public int age;
  public void info(){
    System.out.println("Name:"+this.name+";nAge:"+this.age);
  }
}

import java.io.*;

public class Main{
  public static void main(String [] args){
    将对象序列化为二进制文件
    Persion p = new Persion();
    p.name = "Joner";
    p.age = 18;
    try {

      //打开一个文件输入流
      FileOutputStream fileOut = new FileOutputStream("D:\test\test.db");
      //建立对象输入流
      ObjectOutputStream out = new ObjectOutputStream(fileOut);
      //输出反序列化对象
      out.writeObject(p);
      out.close();
      fileOut.close();
      System.out.printf("保存成功");
    }catch(IOException i){
      i.printStackTrace();
    }
}

import java.io.*;

public class Main{
  public static void main(String [] args){
    /*从二进制文件中提取对象*/
    Persion persion = null;
    try{
      FileInputStream fileInputStream = new FileInputStream("D:\test\test.db");
      //建立对象输入流
      ObjectInputStream inputStream = new ObjectInputStream(fileInputStream);
      persion = (Persion) inputStream.readObject();
      inputStream.close();
      fileInputStream.close();
    }catch (ClassNotFoundException c){
      System.out.println("对象未找到");
      c.printStackTrace();
      return;
    } catch (FileNotFoundException e) {
      e.printStackTrace();
      return;
    } catch (IOException e) {
      e.printStackTrace();
      return;
    }
    System.out.println("反序列化对象.......");
    System.out.println("Name:"+persion.name);
    System.out.println("Age:"+persion.age);
    }
}

import java.io.*;

public class Main{
  public static void main(String [] args)throws Exception{
    Unsafeclass unsafeclass = new Unsafeclass();
    unsafeclass.name = "hhhhh";
    FileOutputStream fileOutputStream = new FileOutputStream("object");
    ObjectOutputStream objectOutputStream = new ObjectOutputStream(fileOutputStream);
    //将对象写入object文件
    objectOutputStream.writeObject(unsafeclass);
    objectOutputStream.close();

    //从文件中反序列化对象
    FileInputStream fileInputStream = new FileInputStream("object");
    ObjectInputStream objectInputStream = new ObjectInputStream(fileInputStream);
    //恢复对象
    Unsafeclass objectFormDisk = (Unsafeclass)objectInputStream.readObject();
    System.out.println(objectFormDisk.name);
    objectOutputStream.close();
  }
}
class Unsafeclass implements Serializable{
  public String name;
  //重写readObject()方法
  private void readObject(java.io.ObjectInputStream inputStream ) throws IOException , ClassNotFoundException{
    //执行默认的readObdect()方法
    inputStream.defaultReadObject();
    //执行打开计算器命令
    Runtime.getRuntime().exec("calc.exe");
  }
}