1 /*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19 package org.apache.shiro.lang.io;
20
21 import java.beans.XMLDecoder;
22 import java.beans.XMLEncoder;
23 import java.io.BufferedInputStream;
24 import java.io.BufferedOutputStream;
25 import java.io.ByteArrayInputStream;
26 import java.io.ByteArrayOutputStream;
27
28 /**
29 * Serializer implementation that uses the JavaBeans
30 * {@link java.beans.XMLEncoder XMLEncoder} and {@link java.beans.XMLDecoder XMLDecoder} to serialize
31 * and deserialize, respectively.
32 * <p/>
33 * <b>NOTE:</b> The JavaBeans XMLEncoder/XMLDecoder only successfully encode/decode objects when they are
34 * JavaBeans compatible!
35 *
36 * @since 0.9
37 * @deprecated This class should not be used directly because of insecure XMLEncoder/XMLDecoder usage.
38 */
39 @Deprecated(forRemoval = true)
40 public class XmlSerializer implements Serializer {
41
42 /**
43 * Serializes the specified <code>source</code> into a byte[] array by using the
44 * {@link java.beans.XMLEncoder XMLEncoder} to encode the object out to a
45 * {@link java.io.ByteArrayOutputStream ByteArrayOutputStream}, where the resulting byte[] array is returned.
46 *
47 * @param source the Object to convert into a byte[] array.
48 * @return the byte[] array representation of the XML encoded output.
49 */
50 public byte[] serialize(Object source) {
51 if (source == null) {
52 String msg = "argument cannot be null.";
53 throw new IllegalArgumentException(msg);
54 }
55
56 ByteArrayOutputStream bos = new ByteArrayOutputStream();
57 XMLEncoder encoder = new XMLEncoder(new BufferedOutputStream(bos));
58 encoder.writeObject(source);
59 encoder.close();
60
61 return bos.toByteArray();
62 }
63
64 /**
65 * Deserializes the specified <code>serialized</code> source back into an Object by using a
66 * {@link java.io.ByteArrayInputStream ByteArrayInputStream} to wrap the argument and then decode this
67 * stream via an {@link java.beans.XMLDecoder XMLDecoder}, where the
68 * {@link java.beans.XMLDecoder#readObject() readObject} call results in the original Object to return.
69 *
70 * @param serialized the byte[] array representation of the XML encoded output.
71 * @return the original source Object in reconstituted form.
72 */
73 public Object deserialize(byte[] serialized) {
74 if (serialized == null) {
75 throw new IllegalArgumentException("Argument cannot be null.");
76 }
77 ByteArrayInputStream bis = new ByteArrayInputStream(serialized);
78 XMLDecoder decoder = new XMLDecoder(new BufferedInputStream(bis));
79 Object o = decoder.readObject();
80 decoder.close();
81 return o;
82 }
83 }