Java Object Serialization Specification: - Security in Object Serialization - JDK 5 Documentation v1.2.2, Java 2 SDK 英文文档

Java Object Serialization Specification

A.3 Using transient to Protect Important System Resources

Direct handles to system resources, such as file handles, are the kind of information that is relative to an address space and should not be written out as part of an object's persistent state. Therefore, fields that contain this kind of information should be declared transient, which prevents them from being serialized. Note that this is not a new or overloaded meaning for the transient keyword.
If a resource, like a file handle, was not declared transient, the object could be altered while in its serialized state, enabling it to have improper access to resources after it is deserialized.

CONTENTS | PREV | NEXT