Java transient keywords

Hey, although the most familiar is Java, but a lot of Java basic knowledge is not known, such as transient keyword has not been used before, so do not know what its role is, today to do a pen test found a question is about this, so spend a time to organize the use of transient key words, Up and down Posture ~ ~ ~ Well, nonsense not much to say, below the beginning:

1. The role of transient and how to use it

We all know that an object can be serialized as long as the Serilizable interface is implemented, and the Java serialization pattern provides developers with a lot of convenience, and we don't have to relate to the process of specific serialization, as long as this class implements the Serilizable interface, All properties and methods of this class are automatically serialized.

However, in the actual development process, we often encounter such a problem, some properties of this class need to serialize, and other attributes do not need to be serialized, for example, if a user has some sensitive information (such as password, bank card number, etc.), for security purposes, do not want to operate in the network (mainly involved in serialization operations, Local serialization cache is also applicable), the variable that corresponds to this information can be added to the transient keyword. In other words, the life cycle of this field is only stored in the caller's memory and is not persisted to disk.

In short, the Java transient keyword is convenient for us, you only need to implement the Serilizable interface, will not need to serialize the property before adding the keyword transient, when serializing the object, this property will not be serialized to the specified destination.

The example code is as follows:

View Code

The output is:

Read before Serializable:username:alexiapassword:123456read after Serializable:username:Alexiapassword:null

The password field is null, stating that no information was obtained from the file at all when deserializing.

2. Transient use summary

1) Once the variable is transient modified, the variable will no longer be part of the object persistence, and the variable content cannot be accessed after serialization.

2) The Transient keyword can only modify variables, not methods and classes. Note that local variables cannot be modified by the transient keyword. If the variable is a user-defined class variable, the class needs to implement the serializable interface.

3) Variables modified by the Transient keyword can no longer be serialized, and a static variable cannot be serialized, whether or not it is transient modified.

3rd may be some people are confused, because found in the user class in the Username field with the static keyword, the program operation results are still unchanged, that is, the static type of username also read out as "Alexia", this does not contradict with the 3rd said? This is actually true: 3rd is True (a static variable cannot be serialized regardless of whether it is transient), and the value of the static variable username in the deserialized class is the value of the corresponding static variable in the current JVM. This value is not deserialized in the JVM, do not believe? Well, here's what I'm going to prove:

View Code

The result of the operation is:

Read before Serializable:username:alexiapassword:123456read after Serializable:username:jmwangpassword:null

This indicates that the value of the static variable username in the class after deserialization is the value of the corresponding static variable in the current JVM, which is Alexia after the modified Jmwang instead of the value at the time of serialization.

3. Transient use details-are the variables modified by the transient keyword really not serialized?

Consider the following example:

Import Java.io.externalizable;import java.io.file;import java.io.fileinputstream;import java.io.FileOutputStream; Import Java.io.ioexception;import java.io.objectinput;import Java.io.objectinputstream;import java.io.ObjectOutput Import java.io.objectoutputstream;/** * @descripiton externalizable interface * * @author Alexia * @date 2013-10-15 * */publi C Class Externalizabletest implements Externalizable {private transient String content = "Yes, I will be serialized, regardless of whether I am transient key    Word decoration ";    @Override public void Writeexternal (ObjectOutput out) throws IOException {out.writeobject (content);        } @Override public void Readexternal (ObjectInput in) throws IOException, ClassNotFoundException {    Content = (String) in.readobject (); } public static void Main (string[] args) throws Exception {externalizabletest et = new Externalizablete        St ();        ObjectOutput out = new ObjectOutputStream (new FileOutputStream (New File ("Test")); Out.WriteObject (ET);        ObjectInput in = new ObjectInputStream (New FileInputStream ("Test"));        ET = (externalizabletest) in.readobject ();        System.out.println (et.content);        Out.close ();    In.close (); }}

Will the content variables be serialized? Well, I lost the answer, yes, the result is:

Yes, I will be serialized, no matter if I am modified by the transient keyword

What is this, not to say that the variables of the class will not be serialized after the Transient keyword is modified?

We know that in Java, the serialization of objects can be achieved by implementing two interfaces, if the implementation of the serializable interface, then all the serialization will be automatic, if the implementation of the Externalizable interface, then nothing can be automatically serialized, You need to manually specify the variable you want to serialize in the Writeexternal method, regardless of whether it is transient decorated. So the second example outputs the contents of the variable content initialization, NOT NULL.

Java transient keywords