Serialization problem

[wex]

I am persisting a serialized object to a db. I have been able to
write and read it without problem until I recently did some
refractoring of my code and moved the class with gets serialized into
another package. Now I get a ClassNotFoundException. The class is
exactly the same just in another package. I didn't realize the
serialized object cared about it's package location. This is rather
annoying, does anyone know if there is a way around this problem.
Maybe another way to read and write it that doesn't make it so
sensitive? Below is my code to read and write the object.


//READ THE SERIALIZED OBJECT
byte[] buf = rs.getBytes("SERIALIZEDOBJECT");
if (buf != null)
{
ObjectInputStream objectIn = new ObjectInputStream(new
ByteArrayInputStream(buf));
this.serializeddata
=(mbs.data.serializeddata.SerializedDataObject)objectIn.readObject();
}

//write the serialized object
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream oout = new ObjectOutputStream(baos);
oout.writeObject(this.serializeddata);
oout.close();
statement.setObject(3, baos.toByteArray(), Types.OTHER);

 

[Jim Sculley]

I am persisting a serialized object to a db. I have been able to
write and read it without problem until I recently did some
refractoring of my code and moved the class with gets serialized into
another package. Now I get a ClassNotFoundException. The class is
exactly the same just in another package. I didn't realize the
serialized object cared about it's package location.

How else would it know if a serialized 'String' object was a
java.lang.String or a com.someothervendor.String?

This is rather
annoying, does anyone know if there is a way around this problem.

Don't serialize something, change what the thing actually is and then
expect to be able to deserialize it.

Maybe another way to read and write it that doesn't make it so
sensitive?

XML? At least then it would be editable. Of course, you might get by
with a hex editor replacing the package name bytes in the serialized
file. I don't know if this would cause security or bytecode
verification problems though.

Jim S.

 

[Liz]

I am persisting a serialized object to a db. I have been able to
write and read it without problem until I recently did some
refractoring of my code and moved the class with gets serialized into
another package. Now I get a ClassNotFoundException. The class is
exactly the same just in another package. I didn't realize the
serialized object cared about it's package location. This is rather
annoying, does anyone know if there is a way around this problem.
Maybe another way to read and write it that doesn't make it so
sensitive? Below is my code to read and write the object.


//READ THE SERIALIZED OBJECT
byte[] buf = rs.getBytes("SERIALIZEDOBJECT");
if (buf != null)
{
ObjectInputStream objectIn = new ObjectInputStream(new
ByteArrayInputStream(buf));
this.serializeddata
=(mbs.data.serializeddata.SerializedDataObject)objectIn.readObject();
}

//write the serialized object
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream oout = new ObjectOutputStream(baos);
oout.writeObject(this.serializeddata);
oout.close();
statement.setObject(3, baos.toByteArray(), Types.OTHER);

Did you try sprinkling "public" around?

 

[wex]

I am persisting a serialized object to a db. I have been able to
write and read it without problem until I recently did some
refractoring of my code and moved the class with gets serialized into
another package. Now I get a ClassNotFoundException. The class is
exactly the same just in another package. I didn't realize the
serialized object cared about it's package location. This is rather
annoying, does anyone know if there is a way around this problem.
Maybe another way to read and write it that doesn't make it so
sensitive? Below is my code to read and write the object.


//READ THE SERIALIZED OBJECT
byte[] buf = rs.getBytes("SERIALIZEDOBJECT");
if (buf != null)
{
ObjectInputStream objectIn = new ObjectInputStream(new
ByteArrayInputStream(buf));
this.serializeddata
=(mbs.data.serializeddata.SerializedDataObject)objectIn.readObject();
}

//write the serialized object
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream oout = new ObjectOutputStream(baos);
oout.writeObject(this.serializeddata);
oout.close();
statement.setObject(3, baos.toByteArray(), Types.OTHER);

Did you try sprinkling "public" around?

What do you mean by sprinkle public around? The class is a public
class, what else has to be public?