Skip to content

Java: Remove implements Serializable, etc? #255

@ojwb

Description

@ojwb

This was originally added by #43 from @master in 2016. Removal was suggested by @rmuir in #254; this comment from there by @uschindler seems a reasonable summary:

About the serialization: Robert is right, Java serialization should not be used anymore (at least not with Java's native framework) as it allows to cause RCEs or instantiation of arbitrary classes by modifying the serialization stream. It is mainly kept for backwards compatibility with very old code, but new projects should never ever introduce new classes with the marker interface. Apache Lucene dropped all occurrences of Serializable more than 10 years ago and only few people complained (at beginning). Serialization is also one of the reasons why final fields in Java cannot be treated as "final" by the optimizer, because seriealization (and reflection - but only because of serialization!) needs to be able to modify final fields after creating the instance.

Keeping the `Serializable`` marker interface and the ID does not do any harm, so I think the discussion should be a separate issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions