码迷,mamicode.com
首页 > 编程语言 > 详细

Java安全模型(沙箱or策略)和transient变量

时间:2015-03-07 22:40:27      阅读:229      评论:0      收藏:0      [点我收藏+]

标签:

在研究enum类的源码时,跟踪到Class类的如下代码:

T[] getEnumConstantsShared() {
        if (enumConstants == null) {
            if (!isEnum()) return null;
            try {
                final Method values = getMethod("values");
                java.security.AccessController.doPrivileged(
                    new java.security.PrivilegedAction<Void>() {
                        public Void run() {
                                values.setAccessible(true);
                                return null;
                            }
                        });
                enumConstants = (T[])values.invoke(null);
            }
            // These can happen when users concoct enum-like classes
            // that don‘t comply with the enum spec.
            catch (InvocationTargetException ex) { return null; }
            catch (NoSuchMethodException ex) { return null; }
            catch (IllegalAccessException ex) { return null; }
        }
        return enumConstants;
    }
    private volatile transient T[] enumConstants = null;

在上述代码中有两处标红的代码:

1、java.security.AccessController.doPrivileged...这段代码可参考:《基于 Java 2 运行时安全模型的线程协作》 http://www.ibm.com/developerworks/cn/java/j-lo-rtsecurity/

可惜看完一遍还是晕菜,什么必须要签名之类的,平时也没有遇到过啊,汗啊~~~

2、volatile是解决线程可见性问题的,transient是临时性的变量不会被串行化。

transient的问题可参考如下的代码:

package com.study.java.core.serializable;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.OutputStream;
import java.io.Serializable;

import com.study.java.core.Employee;

public class Person implements Serializable{
    private transient Employee employee=null;
    private String id=null;
    private transient String pwd=null;
    
    public Person( Employee employee ){
        this.employee=employee;
    }
    public String getId() {
        return id;
    }
    public void setId(String id) {
        this.id = id;
    }
    public String getPwd() {
        return pwd;
    }
    public void setPwd(String pwd) {
        this.pwd = pwd;
    }
    
    @Override
    public String toString() {
        return this.getClass().getName()+":id="+id+",pwd="+pwd+",employee:"+employee;
    }
    public static void main(String[] args) {
        Employee employee=new Employee();
        employee.setId("员工1");
        employee.setName("员工姓名");
        Person person=new Person(employee);
        person.setId("001");
        person.setPwd("password");
        
        try {
            OutputStream os=new FileOutputStream("f:"+File.separator+"a.txt");
            ObjectOutputStream oos=new ObjectOutputStream(os);
            oos.writeObject(person);
            oos.flush();
            oos.close();
            InputStream is=new FileInputStream("f:"+File.separator+"a.txt");
            ObjectInputStream ois=new ObjectInputStream(is);
            Person person1=(Person)ois.readObject();
            
            System.out.println(person1.toString());
        } catch (Exception e) {
            // TODO: handle exception
        }
    }
}

从输出结果可以看出:pwd和employee都为null,因为它们都被设置为transient

Java安全模型(沙箱or策略)和transient变量

标签:

原文地址:http://www.cnblogs.com/bluejavababy/p/4321023.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!