Deserialization in Java - Java Training School

Deserialization in Java is the process of converting an object in a serialized form, which is a sequence of bytes, back into its original object form. This process is important in situations where objects need to be stored, transmitted or otherwise persisted in a way that can be reconstructed later.

The process of serialization in Java involves converting the object state into a stream of bytes. The object state includes its fields and values, as well as any references to other objects that it may contain. Once the object has been serialized, the resulting byte stream can be written to a file, sent over a network or stored in a database.

When deserializing an object in Java, the opposite process is applied. The byte stream is read from a file, network or database and converted back into its original object form. This process is accomplished using an ObjectInputStream, which reads the byte stream and creates a new instance of the object with the same state as the original.

Important Points to Note about Deserialization:

Here are some important points to note about Java deserialization:

Deserialization is the process of converting a serialized object back into its original form.
The deserialization process can introduce security vulnerabilities if not handled carefully. Malicious attackers can craft byte streams that exploit weaknesses in the deserialization process to execute arbitrary code on the system.
To mitigate this risk, Java provides various security controls such as ObjectInputFilter, which can be used to whitelist or blacklist specific classes during deserialization.
Deserialization can be slow and resource-intensive, especially for large objects. It’s important to optimize the serialization and deserialization process to minimize performance impact.
When an object is serialized, its state is written to a stream using ObjectOutputStream. Similarly, to deserialize an object, you need to use ObjectInputStream to read the byte stream and convert it back into an object.
It’s important to test the deserialization process thoroughly to ensure that it works as expected and to catch any errors or bugs early.
There are third-party libraries like Jackson or Gson that provide more advanced deserialization features and better security controls.

In summary, Java deserialization is a powerful feature for persisting and transmitting objects in a serialized form, but it also carries security risks that need to be carefully managed. It’s important to be aware of these risks and take appropriate precautions to ensure that deserialization is done safely and efficiently.

How Does Deserialization works?

Java deserialization works by converting a serialized object, which is a stream of bytes representing the object and its state, back into its original object form.

Here are the basic steps involved in the deserialization process:

Create an instance of the ObjectInputStream class. This class is used to read the serialized object from a byte stream.
Use the readObject() method of the ObjectInputStream class to read the serialized object from the byte stream. This method returns the deserialized object.
During deserialization, the object’s class is also loaded into memory. If the class is not already loaded, the JVM looks for the class definition in the classpath and loads it.
Once the object is deserialized, its state is restored. This includes all its fields, including any references to other objects.
If the deserialized object contains references to other objects that have not yet been deserialized, those objects are also deserialized recursively.
Once the deserialization process is complete, the object is fully reconstructed and can be used just like any other object in memory.

Deserialization Code Example:

Here’s an example of deserialization in Java with a working code sample and output:

First, let’s create a sample object that we will serialize and then deserialize:

import java.io.Serializable;

public class Person implements Serializable {
    private static final long serialVersionUID = 1L;

    private String name;
    private int age;

    public Person(String name, int age) {
        this.name = name;
        this.age = age;
    }

    public String getName() {
        return name;
    }

    public int getAge() {
        return age;
    }
}

This class represents a simple person object with a name and an age. It implements the Serializable interface, which indicates that it can be serialized and deserialized.

Now let’s create a class that serializes and then deserializes this object:

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;

public class SerializationDemo {

    public static void main(String[] args) throws Exception {
        Person person = new Person("John Doe", 30);

        // Serialize the person object to a file
        FileOutputStream fileOut = new FileOutputStream("person.ser");
        ObjectOutputStream out = new ObjectOutputStream(fileOut);
        out.writeObject(person);
        out.close();
        fileOut.close();

        // Deserialize the person object from the file
        FileInputStream fileIn = new FileInputStream("person.ser");
        ObjectInputStream in = new ObjectInputStream(fileIn);
        Person deserializedPerson = (Person) in.readObject();
        in.close();
        fileIn.close();

        // Output the deserialized person's name and age
        System.out.println("Deserialized Person: " + deserializedPerson.getName() + ", " + deserializedPerson.getAge());
    }
}

In this example, we first create a new person object and then serialize it to a file called “person.ser” using ObjectOutputStream. We then deserialize the object from the file using ObjectInputStream and cast the result to a Person object. Finally, we output the deserialized person’s name and age to the console.

When we run this code, we should see the following output:

Deserialized Person: John Doe, 30

This output confirms that the deserialization process worked correctly and that we were able to successfully recreate the person object from its serialized form.