readObject() method must not call any overridable methods. Invoking overridable methods from the
readObject() method can provide the overriding method with access to the object's state before it is fully initialized. This premature access is possible because, in deserialization,
readObject plays the role of object constructor and therefore object initialization is not complete until
readObject exits (see also MET06-J. Do not invoke overridable methods in clone()).
Noncompliant Code Example
This noncompliant code example invokes an overridable method from the
This compliant solution removes the call to the overridable method. When removing such calls is infeasible, declare the method private or final.
readObject() method may invoke the overridable methods
readFields() in class
java.io.ObjectInputStream [SCG 2009].
Invoking overridable methods from the
readObject() method can lead to initialization errors.
|CERT.SER09.VREADOBJ||Do not invoke overridable methods from the readObject() method|
Guideline 7-4 / OBJECT-4: Prevent constructors from calling methods that can be overridden