查看本类的 API文档回源码主页

   /*
    * Copyright 2012 The Netty Project
    *
    * The Netty Project licenses this file to you under the Apache License,
    * version 2.0 (the "License"); you may not use this file except in compliance
    * with the License. You may obtain a copy of the License at:
    *
    *   https://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
   * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
   * License for the specific language governing permissions and limitations
   * under the License.
   */
  package io.netty.handler.codec.serialization;
  
  import io.netty.buffer.ByteBuf;
  import io.netty.buffer.ByteBufOutputStream;
  import io.netty.channel.ChannelHandler.Sharable;
  import io.netty.channel.ChannelHandlerContext;
  import io.netty.handler.codec.MessageToByteEncoder;
  
  import java.io.ObjectInputStream;
  import java.io.ObjectOutputStream;
  import java.io.Serializable;
  
  /**
   * An encoder which serializes a Java object into a {@link ByteBuf}.
   * <p>
   * Please note that the serialized form this encoder produces is not
   * compatible with the standard {@link ObjectInputStream}.  Please use
   * {@link ObjectDecoder} or {@link ObjectDecoderInputStream} to ensure the
   * interoperability with this encoder.
   * <p>
   * <strong>Security:</strong> serialization can be a security liability,
   * and should not be used without defining a list of classes that are
   * allowed to be desirialized. Such a list can be specified with the
   * <tt>jdk.serialFilter</tt> system property, for instance.
   * See the <a href="https://docs.oracle.com/en/java/javase/17/core/serialization-filtering1.html">
   * serialization filtering</a> article for more information.
   *
   * @deprecated This class has been deprecated with no replacement,
   * because serialization can be a security liability
   */
  @Deprecated
  @Sharable
  public class ObjectEncoder extends MessageToByteEncoder<Serializable> {
      private static final byte[] LENGTH_PLACEHOLDER = new byte[4];
  
      @Override
      protected void encode(ChannelHandlerContext ctx, Serializable msg, ByteBuf out) throws Exception {
          int startIdx = out.writerIndex();
  
          ByteBufOutputStream bout = new ByteBufOutputStream(out);
          ObjectOutputStream oout = null;
          try {
              bout.write(LENGTH_PLACEHOLDER);
              oout = new CompactObjectOutputStream(bout);
              oout.writeObject(msg);
              oout.flush();
          } finally {
              if (oout != null) {
                  oout.close();
              } else {
                  bout.close();
              }
          }
  
          int endIdx = out.writerIndex();
  
          out.setInt(startIdx, endIdx - startIdx - 4);
      }
  }