Java序列化和反序列化出現(xiàn)漏洞的解決方案

public class implements java.io.Serializable{
  public String name;
  public int age;
  public void info(){
    System.out.println("Name:"+this.name+";nAge:"+this.age);
  }
}

import java.io.*;

public class Main{
  public static void main(String [] args){
    將對象序列化為二進(jìn)制文件
    Persion p = new Persion();
    p.name = "Joner";
    p.age = 18;
    try {

      //打開一個文件輸入流
      FileOutputStream fileOut = new FileOutputStream("D:\test\test.db");
      //建立對象輸入流
      ObjectOutputStream out = new ObjectOutputStream(fileOut);
      //輸出反序列化對象
      out.writeObject(p);
      out.close();
      fileOut.close();
      System.out.printf("保存成功");
    }catch(IOException i){
      i.printStackTrace();
    }
}

import java.io.*;

public class Main{
  public static void main(String [] args){
    /*從二進(jìn)制文件中提取對象*/
    Persion persion = null;
    try{
      FileInputStream fileInputStream = new FileInputStream("D:\test\test.db");
      //建立對象輸入流
      ObjectInputStream inputStream = new ObjectInputStream(fileInputStream);
      persion = (Persion) inputStream.readObject();
      inputStream.close();
      fileInputStream.close();
    }catch (ClassNotFoundException c){
      System.out.println("對象未找到");
      c.printStackTrace();
      return;
    } catch (FileNotFoundException e) {
      e.printStackTrace();
      return;
    } catch (IOException e) {
      e.printStackTrace();
      return;
    }
    System.out.println("反序列化對象.......");
    System.out.println("Name:"+persion.name);
    System.out.println("Age:"+persion.age);
    }
}

import java.io.*;

public class Main{
  public static void main(String [] args)throws Exception{
    Unsafeclass unsafeclass = new Unsafeclass();
    unsafeclass.name = "hhhhh";
    FileOutputStream fileOutputStream = new FileOutputStream("object");
    ObjectOutputStream objectOutputStream = new ObjectOutputStream(fileOutputStream);
    //將對象寫入object文件
    objectOutputStream.writeObject(unsafeclass);
    objectOutputStream.close();

    //從文件中反序列化對象
    FileInputStream fileInputStream = new FileInputStream("object");
    ObjectInputStream objectInputStream = new ObjectInputStream(fileInputStream);
    //恢復(fù)對象
    Unsafeclass objectFormDisk = (Unsafeclass)objectInputStream.readObject();
    System.out.println(objectFormDisk.name);
    objectOutputStream.close();
  }
}
class Unsafeclass implements Serializable{
  public String name;
  //重寫readObject()方法
  private void readObject(java.io.ObjectInputStream inputStream ) throws IOException , ClassNotFoundException{
    //執(zhí)行默認(rèn)的readObdect()方法
    inputStream.defaultReadObject();
    //執(zhí)行打開計算器命令
    Runtime.getRuntime().exec("calc.exe");
  }
}