Resolving Classes

The readObject( ) method of java.io.ObjectInputStream only creates new objects from known classes in the local classpath. If a class for an object can't be found, readObject( ) tHRows a ClassNotFoundException. It does not read the class data from the object stream. This is limiting for some things you might want to do, particularly RMI. Therefore, trusted subclasses of ObjectInputStream may be allowed to load classes from the stream or some other source like a URL. Specifically, a class is trusted if, and only if, it was loaded from the local classpath (that is, the ClassLoader object returned by getClassLoader( ) is null).

Two protected methods are involved. The first is the annotateClass( ) method of ObjectOutputStream :

protected void annotateClass(Class c) throws IOException

In ObjectOutputStream, this is a do-nothing method. A subclass of ObjectOutputStream can provide a different implementation that provides data for the class. For instance, this might be the byte code of the class itself or a URL where the class can be found.

Standard object input streams cannot read and resolve the class data written by annotateClass( ). For each subclass of ObjectOutputStream that overrides annotateClass( ), there will normally be a corresponding subclass of ObjectInputStream that implements the resolveClass( ) method:

protected Class resolveClass(ObjectStreamClass c)
 throws IOException, ClassNotFoundException

In java.io.ObjectInputStream, this is a do-nothing method. A subclass of ObjectInputStream can provide an implementation that loads a class based on the data read from the stream. For instance, if annotateClass( ) wrote byte code to the stream, the resolveClass( ) method would need to have a class loader that read the data from the stream. If annotateClass( ) wrote the URL of the class to the stream, the resolveClass( ) method would need a class loader that read the URL from the stream and downloaded the class from that URL.

The resolveClass( ) method is called exactly once for each class encountered in the stream (not just those written by annotateClass( )). resolveClass( ) is responsible for knowing what sort of data needs to be read to reconstruct the class and for reading it from the input stream. resolveClass( ) should then load and return the class. If it can't do so, it should throw a ClassNotFoundException. If it returns a class, but that class's SUID does not match the SUID of the class in the stream, the runtime throws a ClassNotFoundException.