Java中的序列化和反序列化使用及解读

import java.io.*;

// 可序列化的类
public class Person implements Serializable {
    // 序列化版本号（强烈建议）
    private static final long serialVersionUID = 1L;
    
    private String name;
    private int age;
    
    // transient 关键字：该字段不会被序列化
    private transient String password;
    
    public Person(String name, int age, String password) {
        this.name = name;
        this.age = age;
        this.password = password;
    }
    
    // getters and setters...
    @Override
    public String toString() {
        return "Person{name='" + name + "', age=" + age + ", password='" + password + "'}";
    }
}

public class SerializationDemo {
    public static void serialize(Object obj, String filename) throws IOException {
        try (ObjectOutputStream oos = new ObjectOutputStream(
                new FileOutputStream(filename))) {
            oos.writeObject(obj);
            System.out.println("对象序列化成功！");
        }
    }
    
    public static Object deserialize(String filename) throws IOException, ClassNotFoundException {
        try (ObjectInputStream ois = new ObjectInputStream(
                new FileInputStream(filename))) {
            Object obj = ois.readObject();
            System.out.println("对象反序列化成功！");
            return obj;
        }
    }
    
    public static void main(String[] args) {
        Person person = new Person("张三", 25, "123456");
        
        try {
            // 序列化
            serialize(person, "person.ser");
            
            // 反序列化
            Person deserializedPerson = (Person) deserialize("person.ser");
            System.out.println("反序列化后的对象: " + deserializedPerson);
            // 输出: Person{name='张三', age=25, password='null'} (password为null因为transient)
            
        } catch (IOException | ClassNotFoundException e) {
            e.printStackTrace();
        }
    }
}

private static final long serialVersionUID = 1L;

private transient String password;  // 不会被序列化

public class CustomPerson implements Serializable {
    private String name;
    private int age;
    
    // 自定义序列化方法
    private void writeObject(ObjectOutputStream oos) throws IOException {
        oos.defaultWriteObject();  // 默认序列化
        // 可以添加额外的序列化逻辑
    }
    
    // 自定义反序列化方法
    private void readObject(ObjectInputStream ois) 
            throws IOException, ClassNotFoundException {
        ois.defaultReadObject();  // 默认反序列化
        // 可以添加额外的反序列化逻辑
    }
}

import java.io.*;

public class ExternalizablePerson implements Externalizable {
    private String name;
    private int age;
    
    // 必须有无参构造器
    public ExternalizablePerson() {}
    
    public ExternalizablePerson(String name, int age) {
        this.name = name;
        this.age = age;
    }
    
    @Override
    public void writeExternal(ObjectOutput out) throws IOException {
        out.writeObject(name);
        out.writeInt(age);
    }
    
    @Override
    public void readExternal(ObjectInput in) 
            throws IOException, ClassNotFoundException {
        name = (String) in.readObject();
        age = in.readInt();
    }
}

// 反序列化可能存在安全风险
Object obj = ois.readObject();  // 可能执行恶意代码

import com.fasterxml.jackson.databind.ObjectMapper;

ObjectMapper mapper = new ObjectMapper();

// 序列化为 JSON
String json = mapper.writeValueAsString(person);

// 从 JSON 反序列化
Person person = mapper.readValue(json, Person.class);

// 需要定义 .proto 文件
// 高性能、跨语言、体积小