序列化与反序列化

┌──────────┐     序列化      ┌──────────┐     传输/存储     ┌──────────┐
│   对象   │ ─────────────→ │  字节流   │ ───────────────→ │ 文件/网络 │
└──────────┘                └──────────┘                  └──────────┘
                                                                  │
                                                                  ↓ 反序列化
┌──────────┐     反序列化    ┌──────────┐                    ┌──────────┐
│   对象   │ ←───────────── │  字节流   │ ←───────────────── │ 文件/网络 │
└──────────┘                └──────────┘                    └──────────┘

public class User implements Serializable {
    private static final long serialVersionUID = 1L;  // 版本号
    
    private String name;
    private int age;
    private transient String password;  // 不参与序列化
    
    // getters, setters
}
 
// 序列化
User user = new User("张三", 25, "123456");
try (ObjectOutputStream oos = new ObjectOutputStream(
        new FileOutputStream("user.dat"))) {
    oos.writeObject(user);
}
 
// 反序列化
try (ObjectInputStream ois = new ObjectInputStream(
        new FileInputStream("user.dat"))) {
    User user = (User) ois.readObject();
}

syntax = "proto3";

message User {
    string name = 1;
    int32 age = 2;
}

// 序列化
User user = User.newBuilder()
    .setName("张三")
    .setAge(25)
    .build();
byte[] bytes = user.toByteArray();
 
// 反序列化
User user2 = User.parseFrom(bytes);

ObjectMapper mapper = new ObjectMapper();
 
// 序列化
User user = new User("张三", 25);
String json = mapper.writeValueAsString(user);
// {"name":"张三","age":25}
 
// 反序列化
User user2 = mapper.readValue(json, User.class);

Kryo kryo = new Kryo();
 
// 序列化
User user = new User("张三", 25);
try (Output output = new Output(new FileOutputStream("user.bin"))) {
    kryo.writeObject(output, user);
}
 
// 反序列化
try (Input input = new Input(new FileInputStream("user.bin"))) {
    User user2 = kryo.readObject(input, User.class);
}

// 序列化
User user = new User("张三", 25);
ByteArrayOutputStream bos = new ByteArrayOutputStream();
Hessian2Output output = new Hessian2Output(bos);
output.writeObject(user);
output.flush();
byte[] bytes = bos.toByteArray();
 
// 反序列化
ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
Hessian2Input input = new Hessian2Input(bis);
User user2 = (User) input.readObject();

// 危险！反序列化可能执行恶意代码
ObjectInputStream ois = new ObjectInputStream(input);
Object obj = ois.readObject();  // 可能触发恶意代码执行