Yong Hao Gao [
http://community.jboss.org/people/gaohoward] commented on the document
"Modular Serialization"
To view all comments on this document, visit:
http://community.jboss.org/docs/DOC-17244#comment-7733
--------------------------------------------------
Refering to Problem C, considering the following case:
1. The framework load Foo class, and the application new a Foo object.
2. The application uses services provided by the thirdparty.jar, which is loaded by the
framework too.
3. The application then pass Foo object to thirdparty service where it is serialized.
There should be no problem because the serialization doesn't need classloader to
participate.
4. Later application reqests the Foo object from the 3rd party service. So the 3rd party
tries to deserialize the Foo object, but unfortunately the classloader used to load Foo
class is not seen by 3rdparty service because the application explicitly asked the
framework to do so in its deployment config.
It's all happened within one VM. If the framework doesn't deploy the app as an
isolated component, the 3rdparty will have no problem deserializing it.
In that case the 3rd party doesn't know beforehand how the serialized object's
class is loaded and so is completely innocent of the problem. But the application and the
framework are fully aware of the problem, and should do something properly to avoid this.
--------------------------------------------------