第 85 条:其他序列化优先于 Java 序列化

其他序列化优先于 Java 序列化.jpeg
// Deserialization bomb - deserializing this stream takes forever
static byte[] bomb() {
    Set root = new HashSet<>();
    Set s1 = root;
    Set s2 = new HashSet<>();
    for (int i = 0; i < 100; i++) {
        Set t1 = new HashSet<>();
        Set t2 = new HashSet<>();
        t1.add("foo"); // Make t1 unequal to t2
        s1.add(t1); s1.add(t2);
        s2.add(t1); s2.add(t2);
        s1 = t1;
        s2 = t2;
    }
    return serialize(root); // Method omitted for brevity
}
 

                            
                        
                    
                    
                    

你可能感兴趣的:(第 85 条:其他序列化优先于 Java 序列化)