跟进：Java中的实例控件，没有枚举

Question

这是此问题的后续措施。该解决方案防水吗？

public final class Thing implements Serializable {

    private static final long serialVersionUID = 1L;

    private static final Thing[] instances = new Thing[2];
    private static int nextOrdinal = 0;

    public static final Thing instance0 = new Thing("whatever0");
    public static final Thing instance1 = new Thing("whatever1");

    private transient final String someState;

    public String someMethod() {return someState;}

    private final int ordinal;

    private Thing(String someState) {
        this.someState = someState;
        this.ordinal = nextOrdinal++;
        instances[this.ordinal] = this;
    }

    private Object readResolve() throws ObjectStreamException {
        return instances[this.ordinal];
    }
}

Answer 1

该解决方案防水吗？

否。（尽管可能就足够了，取决于使用代码的方式和位置。）

在 条目77：例如实例控件中，更喜欢枚举类型来读取readResolve （Effective
Java，第二版
），Bloch演示了攻击者如何使像您这样的类返回任何值。攻击依赖于手工字节输入并能够在目标上运行代码（因此，如果在沙盒环境，某些RMI案例等中使用代码，则代码可能会带来安全风险）。我不知道这是否是唯一的攻击-
这是唯一提到的攻击。解决的办法是声明所有字段都是瞬态的，但是这样就存在如何存储值的问题。

您可以使用 序列化代理模式 来解决这些问题（本书中的第78项-有一个读它的Java程序员推荐这样做的原因）。

public final class Thing implements Serializable {
  private static final long serialVersionUID = 1L;
  private static final Thing[] INSTANCES = new Thing[2];
  private static int NEXT_ORDINAL = 0;

  public static final Thing INSTANCE0 = new Thing(
      "whatever0");
  public static final Thing INSTANCE1 = new Thing(
      "whatever1");

  private transient final String someState;

  public String someMethod() {
    return someState;
  }

  private final int ordinal;

  private Thing(String someState) {
    this.someState = someState;
    ordinal = NEXT_ORDINAL++;
    INSTANCES[ordinal] = this;
  }

  private Object writeReplace() {
    return new ThingProxy(this);
  }

  private void readObject(ObjectInputStream stream)
      throws InvalidObjectException {
    throw new InvalidObjectException("Proxy required");
  }

  private static class ThingProxy implements Serializable {
    private static final long serialVersionUID = 1L;
    private final int ordinal;

    private ThingProxy(Thing t) {
      ordinal = t.ordinal;
    }

    private Object readResolve()
        throws ObjectStreamException {
      return INSTANCES[ordinal];
    }

  }

}

但是，就像从互联网上复制任何与安全相关的内容一样，需要警告。我绝不是专家。