readObject() method of
java.io.ObjectInputStream only creates new objects
from known classes. It doesn’t load classes. If a class for an
object can’t be found,
readObject() throws a
ClassNotFoundException. It specifically does not
attempt to read the class data from the object stream. This is
limiting for some things you might want to do, particularly RMI.
Therefore, trusted subclasses of
may be allowed to load classes from the stream or some other source
like a URL. Specifically, a class is trusted if, and only if, it was
loaded from the local class path; that is, the
ClassLoader object returned by
Two protected methods are involved. The first is the
annotateClass() method of
protected void annotateClass(Class c) throws IOException
ObjectOutputStream this is a do-nothing method.
A subclass of
ObjectOutputStream can provide a
different implementation that provides data for the class. For
instance, this might be the byte code of the class itself or a URL
where the class can be found.
Standard object input streams cannot read and resolve the class data
annotateClass(). For each subclass of
ObjectOutputStream that overrides
annotateClass(), there will normally be a
corresponding subclass of
protected Class resolveClass(ObjectStreamClass v) throws IOException, ClassNotFoundException
java.io.ObjectInputStream, this is a do-nothing ...