joyoyoyoyoyo

import sun.plugin.javascript.navig.Array;

import java.io.*;
import java.util.Arrays;

public class WriteObjectArray {
    public static void main(String[] args) {
        Person[] people = {new Person(3, "Igor"), new Person (4 , "Max")};
        try {
            FileOutputStream fileOutputStream = new FileOutputStream("people.bin");

joyoyoyoyoyo

package com.luxoft.datastructures.list;

import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.sql.Date;
import java.util.Collection;
import java.util.List;

joyoyoyoyoyo

package util.io;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;

import org.slf4j.Logger;

joyoyoyoyoyo

import java.io.Serializable;
import java.util.*;

public class Group implements Serializable{
  private final int groupNum;
  private final String groupName;

  public Group(int groupNum, String gName) {
    this.groupNum = groupNum;
    this.students = new HashMap<Student, Boolean>();

joyoyoyoyoyo

package com.javarush.task.task20.task2017;

import java.io.*;

/* 
Десериализация
*/
public class Solution {
    public A getOriginalObject(ObjectInputStream objectStream) throws IOException, ClassNotFoundException {
        A ab = (A) objectStream.readObject();

joyoyoyoyoyo

JSON (первая сериализация).txt

package com.javarush.task.task33.task3301;

import com.fasterxml.jackson.annotation.JsonAutoDetect;
import com.fasterxml.jackson.annotation.JsonSubTypes;
import com.fasterxml.jackson.annotation.JsonTypeInfo;
import com.fasterxml.jackson.databind.ObjectMapper;

import java.io.IOException;

joyoyoyoyoyo

import com.google.common.collect.Maps;
import com.google.common.io.ByteStreams;
import org.jboss.serial.io.JBossObjectInputStream;
import org.jboss.serial.io.JBossObjectOutputStream;
import org.junit.Test;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;

joyoyoyoyoyo

public static <T> T deepCopy(T o) throws Exception {  
  ByteArrayOutputStream baos = new ByteArrayOutputStream();  
  new ObjectOutputStream(baos).writeObject(o);  
  ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());  
  return (T) new ObjectInputStream(bais).readObject();  
}

joyoyoyoyoyo

import java.io.*;

public class A implements Serializable {
    private static final long serialVersionUID = 100L;

    private int value;

    public A(int n) {
        this.value = n;
    }

joyoyoyoyoyo

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

http://fishbowl.pastiche.org/2015/11/09/java_serialization_bug/

http://www.infoq.com/news/2015/11/commons-exploit

http://www.slideshare.net/frohoff1/appseccali-2015-marshalling-pickles

https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli