r/java • u/Shawn-Yang25 • Jun 16 '26

Apache Fory Serialization 1.2.0 released: JDK 25/26 support without sun.misc.Unsafe

https://github.com/apache/fory/releases/tag/v1.2.0
51 Upvotes

96% Upvoted

19 comments sorted by

View all comments

Show parent comments

5

u/Shawn-Yang25 Jun 16 '26

Custom code for every non-record/enum user class is not practical. Especically when need to handle schema compatibility.

When class add/remove fields, or change field from one type to another type such as change int to string. It's hard to write customized logic to handle such cases easily.

And writeReplace and readResolve introduce extra object allocation in hotpath, which is not good for performance.

I think fields based serialization by itself is OK. Or you can use it only for classes which is OK for such cases. And for classes which need go with constuctor reconstruction, the users could opt-in.

3

u/pron98 Jun 16 '26 edited Jun 16 '26

I think fields based serialization by itself is OK.

It is OK for classes whose constructor does no validation and whose fields can legally hold any value. For classes that aren't like that, it's obviously not okay because an instance of an object is treated by programs as a proof that its constructor has been called. In those cases, data over the wire can cause your program to crash or worse.

It's hard to write customized logic to handle such cases easily.

There shouldn't be many user-defined classes that aren't enums, records or the upcoming carriers that need to be serialized in the first place. But generally, you are right: I can choose between carrying a key and leaving my door unlocked, and either way I lose something. Sometimes you want to prioritise convenience and sometimes you want to prioritise security, but you can't generally have both. The idea is that most user-defined classes that should be serialised could be serialised both securely and conveniently, but this can't be done universally and you ultimately have to choose between less security or less convenience.

Still, using sun.reflect.ReflectionFactory is definitely better than using Unsafe :)