Page History

Wiki Markup"An inner class is a nested class that is not explicitly or implicitly declared static." \[[JLS 05 Section 8.1.3, Inner Classes and Enclosing Instances|http://java.sun.com/docs/books/jls/third_edition/html/classes.html#8.1.3]\]. Serialization of inner classes (including local and anonymous classes) is error prone. According to \[[Sun 06|AA. Java References#Sun 06]\], Serialization specification:

...

[JLS 2015]. Serialization of inner classes (including local and anonymous classes) is error prone. According to the Serialization Specification [Sun 2006]:

• Serializing an inner class declared in a non-static context that contains implicit non-transient references to enclosing class instances

...

• results in serialization of its associated outer class instance.

• Synthetic fields generated by

...

• Java

...

• compilers

...

• to implement inner classes are implementation dependent and may vary between compilers; differences in such fields can disrupt compatibility as well as result in conflicting default serialVersionUID values. The names assigned to local and anonymous inner classes are also implementation dependent and may differ between compilers.

• Because inner classes cannot declare static members other than compile-time constant fields, they cannot use the serialPersistentFields mechanism to designate serializable fields.

...

• Because inner classes associated with outer instances do not have zero-argument

...

• constructors

...

• (constructors

...

• of

...

• such

...

• inner

...

• classes

...

• implicitly

...

• accept

...

• the

...

• enclosing

...

• instance

...

• as

...

• a

...

• prepended

...

• parameter),

...

• they

...

• cannot

...

• implement

...

• Externalizable

...

• .

...

• The

...

• Externalizable

...

• interface

...

• requires

...

• the

...

• implementing

...

• object

...

• to

...

• manually

...

• save

...

• and

...

• restore

...

• its

...

• state

...

• using

...

• the

...

• writeExternal()

...

• and

...

• readExternal()

...

• methods.

Consequently, programs must not serialize inner classes.

Because none None of these issues , however, apply to static member classes, serialization of static member classes is permitted.

Noncompliant Code Example

In this noncompliant code example, the fields contained within the outer class are also serialized when the inner class is serialized. :

public class OuterSer implements Serializable {
  private int ssnrank;
  class InnerSer implements Serializable {
    protected String name;
    // ...
  }
}

Compliant Solution

This The InnerSer class of this compliant solution recommends against implementing deliberately fails to implement the Serializable interface in the InnerSer class.:

public class OuterSer implements Serializable {
  private int ssnrank;
  class InnerSer {
    protected String name;
    // ...
  }
}

Compliant Solution

It is also allowable to declare If an inner and outer class must both be Serializable, the inner class as can be declared static to prevent its serializationa serialized inner class from also serializing its outer class.

public class OuterSer implements Serializable {
  private int ssnrank;
  static class InnerSer implements Serializable {
    protected String name;
    // ...
  }
}

Risk Assessment

Attempting to serialize Serialization of inner classes can introduce platform dependencies and can cause serialization of instances of the outer class to be serialized and also discourage platform independence.

Automated Detection

...

Detection of inner classes that implement serialization is straightforward.

Tool	Version	Checker	Description
Klocwork	Include Page Klocwork_V Klocwork_V	JAVA.SERIALIZE.INNER
SonarQube	Include Page SonarQube_V SonarQube_V	S2066 S2059	"Serializable" inner classes of non-serializable classes should be "static" "Serializable" inner classes of "Serializable" classes should be static

Related Guidelines

Bibliography

...

Image Added Image Added Image Added

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[API 06|AA. Java References#API 06]\]
\[[Sun 06|AA. Java References#Sun 06]\] "Serialization specification:  
\[[Bloch 08|AA. Java References#Bloch 08]\] Item 74: "Implement serialization judiciously"

SER32-J. Do not allow serialization and deserialization to bypass the Security Manager      11. Serialization (SER)      11. Serialization (SER)