序列化破坏单例模式以及如何防御的应用与Debug分析

淡淡的烟草味﹌ 2023-07-01 14:59 8阅读 0赞

推荐：[Java设计模式汇总][Java]

## 序列化破坏单例模式以及如何防御的应用与Debug分析 ##

需要了解实现单例模式的各种方法，可以参考下方这篇博客。  
[设计模式-单例模式（Singleton Pattern）][-_Singleton Pattern]  
单例模式类Singleton，是使用静态内部类实现的单例模式，并且实现`Serializable接口`（不实现`Serializable接口`进行序列化会报错）。

package com.kaven.design.pattern.creational.singleton;
    
    import java.io.Serializable;
    
    public class Singleton implements Serializable { 
        private Singleton(){ }
    
        public static Singleton getInstance(){ 
            return Inner.instance;
        }
        
        private static class Inner{ 
            private static final Singleton instance = new Singleton();
        }
    }

接下来使用序列化来破坏这个单例模式类，其他方法实现的单例模式类也可进行这种破坏，除了枚举方式实现的单例模式类。  
[为什么要用枚举实现单例模式(避免反射、序列化问题)][Link 1]

package com.kaven.design.pattern.creational.singleton;
    
    import java.io.*;
    
    public class DestroyTest { 
        public static void main(String[] args) throws IOException, ClassNotFoundException { 
            Singleton instance = Singleton.getInstance();
            ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("singleton_file"));
            oos.writeObject(instance);
    
            File file = new File("singleton_file");
            ObjectInputStream ois = new ObjectInputStream(new FileInputStream(file));
            Singleton newInstance = (Singleton) ois.readObject();
    
            System.out.println(instance);
            System.out.println(newInstance);
            System.out.println(instance == newInstance);
        }
    }

结果：

com.kaven.design.pattern.creational.singleton.Singleton@7f31245a
    com.kaven.design.pattern.creational.singleton.Singleton@568db2f2
    false

怎么解决呢？  
在`Singleton类`中增加`readResolve()方法`，并且该方法返回`Inner.instance`。

package com.kaven.design.pattern.creational.singleton;
    
    import java.io.Serializable;
    import java.util.concurrent.atomic.AtomicInteger;
    
    public class Singleton implements Serializable { 
        private static AtomicInteger count = new AtomicInteger();
    
        private Singleton(){ 
            count.getAndAdd(1);
        }
    
        public static Singleton getInstance(){ 
            return Inner.instance;
        }
    
        public static AtomicInteger getCount() { 
            return count;
        }
        private static class Inner{ 
            private static final Singleton instance = new Singleton();
        }
    
        private Object readResolve(){ 
            return Inner.instance;
        }
    }

看看结果：

com.kaven.design.pattern.creational.singleton.Singleton@7f31245a
    com.kaven.design.pattern.creational.singleton.Singleton@7f31245a
    true

这样为什么就正确了？  
我们来Debug一下。  
把`DestroyTest类`中这一行打上断点。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70]  
按住CTRL，点击`readObject()方法`，进入该方法，在调用`readObject0()方法`这一行打上断点，并且进入该方法。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 1]  
在`readObject0()方法`中如图所示位置打上断点，并且进入`readOrdinaryObject()方法`。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 2]  
在`readOrdinaryObject()方法`中如下图所示两个位置打上断点。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 3]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 4]  
进入`invokeReadResolve()方法`中，在如图所示位置打上断点。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 5]  
最后在`Singleton类`中新添加的`readResolve()方法`如图所示位置打上断点。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 6]  
我们开始Debug。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 7]  
读取实例对象。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 8]  
进一步读取实例对象。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 9]  
再进一步读取实例对象。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 10]  
进入如图所示位置的断点，首先调用`isInstantiable()方法`，判断`Singleton类`是否有构造器。我们这里是有的，就会调用`newInstance()方法`，通过反射创建出`Singleton类`实例，所以这里总是会重新创建一个`Singleton类`实例，不管我们是否添加`readResolve()方法`。

下图中desc的值如下（下图可见）：

com.kaven.design.pattern.creational.singleton.Singleton: static final long serialVersionUID = 739035658457974510L;

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 11]  
调用`invokeReadResolve()方法`。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 12]  
调用`invoke()方法`。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 13]  
再通过反射调用`readResolve()`方法。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 14]  
最后进入了`readResolve()方法`。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 15]  
通过Debug，我们应该已经清楚了，程序总会创建一个新的`Singleton类`实例，但是程序最后会调用我们写的`readResolve()方法`，返回的是之前的`Singleton类`实例，如果我们没有添加`readResolve()方法`，就会返回那个新创建的`Singleton类`实例。

如果有说错的地方，请大家不吝赐教（记得留言哦~~~~）。

扩展阅读：  
[反射破坏单例模式以及如何防御][Link 2]  
[Java transient关键字使用小记][Java transient]

[Java]: https://kaven.blog.csdn.net/article/details/104109975
[-_Singleton Pattern]: https://blog.csdn.net/qq_37960603/article/details/104048354
[Link 1]: https://blog.csdn.net/qq_37960603/article/details/104060119
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200123135624609.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200123135857216.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200123140100188.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200123140519849.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200123141312273.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200123141017865.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20200123141107450.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/20200123141942368.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 8]: https://img-blog.csdnimg.cn/20200123142112323.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 9]: https://img-blog.csdnimg.cn/20200123142545205.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 10]: https://img-blog.csdnimg.cn/20200123142720776.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 11]: https://img-blog.csdnimg.cn/20200123142805672.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 12]: https://img-blog.csdnimg.cn/20200123144258174.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 13]: https://img-blog.csdnimg.cn/20200123144707295.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 14]: https://img-blog.csdnimg.cn/20200123144944490.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0_size_16_color_FFFFFF_t_70 15]: https://img-blog.csdnimg.cn/20200123145337762.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9rYXZlbi5ibG9nLmNzZG4ubmV0,size_16,color_FFFFFF,t_70
[Link 2]: https://blog.csdn.net/qq_37960603/article/details/104076323
[Java transient]: https://blog.csdn.net/qq_37960603/article/details/104060531