Member Avatar for gymangel812

I'm trying to create a class that provides object serialization and deserialization methods for use by another class. These two methods (I think) are in the class already (see code below). I'm not sure how I would go about making those 2 methods their own class and then returning the object back to the class I have created.

public static byte[] serializeObj(Object obj)
        throws IOException
        {
           ByteArrayOutputStream baOStream = new ByteArrayOutputStream();
           ObjectOutputStream objOStream = new ObjectOutputStream(baOStream);

           objOStream.writeObject(obj); // object must be Serializable
           objOStream.flush();
           objOStream.close();
           return baOStream.toByteArray(); // returns stream as byte array
        }

        // Method to read bytes from result set into a byte array and then
        // create an input stream and read the data into an object
        public static Object deserializeObj(byte[] buf)
        throws IOException, ClassNotFoundException
        {
           Object obj = null;

           if (buf != null)
           {
           ObjectInputStream objIStream =
           new ObjectInputStream(new ByteArrayInputStream(buf));

           obj = objIStream.readObject(); // throws IOException, ClassNotFoundException
        }
        return obj;
    }
  • 2 Contributors
  • 1 Reply
  • 121 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by JamesCherrill

Dani AI

Generated

Both approaches in this thread are valid. is right that you can move the two methods into a new helper class, but there are a few design and safety considerations that make the difference between a quick hack and a maintainable solution.

If you only need a small reusable utility and no configuration, a final utility class with static methods is fine. If you want testability, pluggability (custom ClassLoader, filters) or per-instance configuration, define a small interface and provide a concrete implementation. For example, an interface can give you a typed fromBytes so callers avoid unchecked casts:

public interface BinarySerializer {
  byte[] toBytes(Object value) throws IOException;
  <T> T fromBytes(byte[] data, Class<T> target) throws IOException, ClassNotFoundException;
}

Implementation notes and gotchas:

  • Always use try-with-resources for streams so they are closed reliably. That avoids subtle leaks and is simpler than manual close calls.
  • Deserialization is a security risk. On modern JDKs use an object input filter (see the ObjectInputFilter API) or whitelist classes to prevent arbitrary code from being instantiated.
  • Versioning: give serializable classes an explicit serialVersionUID to avoid InvalidClassException when class definitions evolve.
  • For database storage prefer BLOB/binary columns and ResultSet#getBytes or streaming via PreparedStatement#setBinaryStream. For very large objects, avoid creating huge in-memory byte[] — stream to/from the DB instead.
  • If you get ClassNotFoundException on read, confirm the exact class (and package) is on the classpath of the process doing deserialization and that the serialVersionUIDs are compatible.

If you need cross-platform, forward/backward compatibility, or much better performance, consider using a structured format (JSON with Jackson/Gson) or a binary library (Kryo, Protocol Buffers) instead of Java native serialization.

References: ObjectOutputStream Javadoc, ObjectInputFilter (security) Javadoc.

Member Avatar for JamesCherrill

Just put them in a new class :

public class Serialiser {
  public static byte[] serializeObj(Object obj)
  // etc

then call them from any other class like this:

byte[] bytes = Serialiser.serialiseObj(myObject);
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.