java-sec-code 反序列化漏洞

java的反序列化

序列化的步骤为

• 创建一个ObjectOutputStream输出流
• 调用ObjectOutputStream.writeObject

反序列化的步骤为

• 创建一个ObjectInputStream输出流
• 调用ObjectInputStream.readObject

示例如下：

package com;

import java.io.Serializable;

public class User implements Serializable {
   
    protected String username = "admin";
    private String passwd = "admin123";
    public int id = 1;
}


package com;

import java.io.*;

public class SerializeDemo {
   
    public static void main(String[] args){
   
        User user = new User();
        try {
   
            ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("output"));
            out.writeObject(user);
            out.</