Top Description Constructors Methods
org.springframework.util

public abstract Class SerializationUtils

extends Object
Class Inheritance
Imports
java.io.ByteArrayInputStream, .ByteArrayOutputStream, .IOException, .ObjectInputStream, .ObjectOutputStream, .Serializable, org.springframework.lang.Nullable
Static utilities for serialization and deserialization using Java Object Serialization.

Warning

These utilities should be used with caution. See Secure Coding Guidelines for the Java Programming Language for details.

Authors
Dave Syer, Loïc Ledoyen, Sam Brannen
Since
3.0.5

Constructor Summary

AccessConstructor and Description
public
SerializationUtils()

Method Summary

Modifier and TypeMethod and Description
public static <
the type of the object to clone
T extends Serializable> T

Returns:

a clone (deep-copy) of the given object
clone(T
the object to clone
object)

Clone the given object using Java Object Serialization.

public static Object

Returns:

the result of deserializing the bytes
deserialize(byte[]
a serialized object
bytes)
Deprecated This utility uses Java Object Serialization, which allows arbitrary code to be run and is known for being the source of many Remote Code Execution (RCE) vulnerabilities.

Deserialize the byte array into an object.

public static byte[]

Returns:

an array of bytes representing the object in a portable fashion
serialize(Object
the object to serialize
object)

Serialize the given object to a byte array.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Constructor Detail

SerializationUtilsback to summary
public SerializationUtils()

Method Detail

cloneback to summary
public static <T extends Serializable> T clone(T object)

Clone the given object using Java Object Serialization.

Parameters
<T>
the type of the object to clone
object:T

the object to clone

Returns:T

a clone (deep-copy) of the given object

Annotations
@SuppressWarnings:unchecked
Since
6.0
deserializeback to summary
public static Object deserialize(byte[] bytes)

Deprecated

This utility uses Java Object Serialization, which allows arbitrary code to be run and is known for being the source of many Remote Code Execution (RCE) vulnerabilities.

Prefer the use of an external tool (that serializes to JSON, XML, or any other format) which is regularly checked and updated for not allowing RCE.

Deserialize the byte array into an object.

Parameters
bytes:byte[]

a serialized object

Returns:Object

the result of deserializing the bytes

Annotations
@Deprecated
@Nullable
serializeback to summary
public static byte[] serialize(Object object)

Serialize the given object to a byte array.

Parameters
object:Object

the object to serialize

Returns:byte[]

an array of bytes representing the object in a portable fashion

Annotations
@Nullable