SerializationUtils

public class org.apache.commons.lang3.SerializationUtils

Performs additional functionality for serialization.

• Deep clone using serialization

• Serialize managing finally and IOException

• Deserialize managing finally and IOException

This class throws exceptions for invalid null inputs. Each method documents its behavior in more detail.

If you want to secure deserialization with a whitelist or blacklist, please use Apache Commons IO’s ValidatingObjectInputStream.

#ThreadSafe#

See also:

• org.apache.commons.io.serialization.ValidatingObjectInputStream

• Java Object Serialization Specification

Since:

1.0

Constructors

SerializationUtils()

Deprecated. SerializationUtils instances should NOT be constructed in standard programming.

@Deprecated public SerializationUtils()

Deprecated: TODO Make private in 4.0.

SerializationUtils instances should NOT be constructed in standard programming. Instead, the class should be used as SerializationUtils.clone(object).

This constructor is public to permit tools that require a JavaBean instance to operate.

Since:

2.0

Methods

clone(Serializable)	Deep clones an Object using serialization.
deserialize(byte[])	Deserializes a single Object from an array of bytes.
deserialize(InputStream)	Deserializes an Object from the specified stream.
requireNonNull(Object, String)	Checks that the specified object reference is not null and throws a customized InvalidObjectException if it is.
roundtrip(Serializable)	Performs a serialization roundtrip.
serialize(Serializable)	Serializes an Object to a byte array for storage/serialization.
serialize(Serializable, OutputStream)	Serializes an Object to the specified stream.

public static <T extends Serializable> T clone(T object)

Deep clones an Object using serialization.

This is many times slower than writing clone methods by hand on all objects in your object graph. However, for complex object graphs, or for those that don’t support deep cloning this can be a simple alternative implementation. Of course all the objects must be Serializable.

Type parameters:

<T> – the type of the object involved.

Parameters:

object – The Serializable object to clone.

Returns:

The cloned object.

Throws:

org.apache.commons.lang3.SerializationException – Thrown if the serialization fails.

See also:

Java Object Serialization Specification

public static <T> T deserialize(byte[] objectData)

Deserializes a single Object from an array of bytes.

If the call site incorrectly types the return value, a ClassCastException is thrown from the call site. Without Generics in this declaration, the call site must type cast and can cause the same ClassCastException. Note that in both cases, the ClassCastException is in the call site, not in this method.

If you want to secure deserialization with a whitelist or blacklist, please use Apache Commons IO’s ValidatingObjectInputStream.

Type parameters:

<T> – the object type to be deserialized.

Parameters:

objectData – The serialized object, must not be null.

Returns:

The deserialized object.

Throws:

• java.lang.NullPointerException – Thrown if objectData is null.

• org.apache.commons.lang3.SerializationException – Thrown if the serialization fails.

See also:

• org.apache.commons.io.serialization.ValidatingObjectInputStream

• Java Object Serialization Specification

@SuppressWarnings({"resource"}) public static <T> T deserialize(InputStream inputStream)

Deserializes an Object from the specified stream.

The stream will be closed once the object is written. This avoids the need for a finally clause, and maybe also exception handling, in the application code.

The stream passed in is not buffered internally within this method. This is the responsibility of your application if desired.

If the call site incorrectly types the return value, a ClassCastException is thrown from the call site. Without Generics in this declaration, the call site must type cast and can cause the same ClassCastException. Note that in both cases, the ClassCastException is in the call site, not in this method.

If you want to secure deserialization with a whitelist or blacklist, please use Apache Commons IO’s ValidatingObjectInputStream.

Type parameters:

<T> – the object type to be deserialized.

Parameters:

inputStream – The serialized object input stream, must not be null.

Returns:

The deserialized object.

Throws:

• java.lang.NullPointerException – Thrown if inputStream is null.

• org.apache.commons.lang3.SerializationException – Thrown if the serialization fails.

See also:

• org.apache.commons.io.serialization.ValidatingObjectInputStream

• Java Object Serialization Specification

public static <T> T requireNonNull(T obj, String message) throws InvalidObjectException

Checks that the specified object reference is not null and throws a customized InvalidObjectException if it is. This method is designed primarily for doing state validation in Serializable class’s readObject(ObjectInputStream) methods.

Parameters:

• obj – The object reference to check for nullity.

• message – detail message to be used in the event that a InvalidObjectException is thrown.

Type parameters:

<T> – the type of the reference.

Returns:

obj if not null.

Throws:

java.io.InvalidObjectException – Thrown if obj is null.

See also:

• Serializable

• Java Object Serialization Specification

Since:

3.21.0

@SuppressWarnings({"unchecked"}) public static <T extends Serializable> T roundtrip(T obj)

Performs a serialization roundtrip. Serializes and deserializes the given object, great for testing objects that implement Serializable.

Type parameters:

<T> – The type of the object involved.

Parameters:

obj – The object to roundtrip.

Returns:

The serialized and deserialized object.

See also:

Java Object Serialization Specification

Since:

3.3

public static byte[] serialize(Serializable obj)

Serializes an Object to a byte array for storage/serialization.

Parameters:

obj – The object to serialize to bytes.

Returns:

A byte[] with the converted Serializable.

Throws:

org.apache.commons.lang3.SerializationException – Thrown if the serialization fails.

See also:

Java Object Serialization Specification

@SuppressWarnings({"resource"}) public static void serialize(Serializable obj, OutputStream outputStream)

Serializes an Object to the specified stream.

The stream will be closed once the object is written. This avoids the need for a finally clause, and maybe also exception handling, in the application code.

The stream passed in is not buffered internally within this method. This is the responsibility of your application if desired.

Parameters:

• obj – The object to serialize to bytes, may be null.

• outputStream – The stream to write to, must not be null.

Throws:

• java.lang.NullPointerException – Thrown if outputStream is null.

• org.apache.commons.lang3.SerializationException – Thrown if the serialization fails.

See also:

Java Object Serialization Specification