Serialization and deserialization monitoring method and device and computer equipment
Through monitoring and exception prompts of serialization and deserialization methods, the deserialization failure caused by class field name changes is solved, and the stability and risk management of the project are improved.
Patent Information
- Application Number
- CN202411361854.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-27
- Publication Date
- 2025-01-03
AI Technical Summary
In project development, the confusion and optimization of the field and method of the class leads to the change of the field name, and may miss field annotations, resulting in the failure of deserialization, affecting the normal operation of the business.
Provide a serialization and deserialization monitoring method, which can determine the target parameters by calling and monitoring the serialization tool class, serialization method and deserialization method, mark the fields that do not need to be serialized, and traverse the unmarked fields to check whether it is There is a serialized name annotation, and an exception prompt is triggered if no annotation is added.
Remind developers to deal with the problem of not adding serialized name annotations, avoid the problem of deserialization failure only when the project is launched or developed and tested, and improve the level of project management and risk management.
Smart Images
Figure CN119248348A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of software development technology, and in particular to a serialization and deserialization monitoring method, device and computer equipment. Background Art
[0002] In daily project development, you often need to serialize Java objects into strings and save them in files, and then deserialize the strings into corresponding objects when needed. Or you can deserialize the string content sent from the server into the corresponding object to convert the object's state information into a format that can be stored or transmitted.
[0003] During the packaging process of the project, the fields and methods of the class will be obfuscated and optimized for reasons such as reducing the package size and security, in order to reduce the package size and improve security. In this process, the name of the field may change. If the field annotation is omitted when writing the code, the corresponding value cannot be found by the key during deserialization, causing deserialization failure and affecting the normal operation of the business. Summary of the invention
[0004] The purpose of this application is to solve at least one of the above technical defects, especially the technical defect that the fields and methods of the class are obfuscated and optimized in order to reduce the package size and improve security in order to reduce the package size and improve security. In this process, the name of the field may change. If the annotation of the field is omitted when writing the code, the corresponding value cannot be found by the key during deserialization, causing the deserialization to fail and affecting the normal operation of the business.
[0005] In a first aspect, the present application provides a serialization and deserialization monitoring method, the method comprising:
[0006] Monitor the calls to serialization tool classes, serialization methods, and deserialization methods;
[0007] When the preset trigger conditions are met, the target parameters are determined;
[0008] Marking the fields with preset target keywords in each field in the target parameter, and traversing the unmarked fields in the target parameter to check whether each traversed field has a serialization name annotation added; the target keyword is used to identify the field that does not need to be serialized;
[0009] If there are fields without the serialization name annotation added in the traversed fields, the fields without the serialization name annotation added in the traversed fields are determined as abnormal fields, and abnormal prompts are triggered according to the abnormal fields.
[0010] In one embodiment, the trigger condition is:
[0011] It is detected that there are parameters passed into the serialization tool class.
[0012] or,
[0013] It is detected that the serialization method or the deserialization method is called.
[0014] In one embodiment, the step of determining the target parameter comprises:
[0015] When it is detected that there are parameters passed into the serialization tool class, the passed-in parameters are determined as target parameters.
[0016] In one embodiment, the step of determining the target parameter comprises:
[0017] When it is detected that the serialization method or the deserialization method is called, the called method is determined as a target method;
[0018] The target method is converted into a static method to obtain the passed-in target parameter from the static method.
[0019] In one embodiment, the step of converting the target method into a static method includes:
[0020] The preset ASM library is called to modify the INVOKEVIRTUAL instruction in the code corresponding to the target method in the bytecode into an INVOKESTATIC instruction, and the target method is called by a static method to complete the conversion of the target method and obtain the static method corresponding to the target method.
[0021] In one embodiment, the target keyword is a transient keyword; the step of marking the fields with the preset target keyword in each field in the target parameter includes:
[0022] Each field in the target parameter is traversed, and when a field with the transient keyword is traversed, the field is marked.
[0023] In one embodiment, the step of triggering an abnormal prompt according to each abnormal field includes:
[0024] According to each abnormal field, determine the code position of each abnormal field;
[0025] According to the code position of each abnormal field, the jump link corresponding to the code position of each abnormal field is determined respectively;
[0026] According to the jump link corresponding to the code position of each exception field, the exception information of each exception field is generated, and the exception information of each exception field is thrown.
[0027] In a second aspect, the present application provides a serialization and deserialization monitoring device, the device comprising:
[0028] The call monitoring module is used to monitor the calls of serialization tool classes, serialization methods, and deserialization methods;
[0029] A parameter determination module, used to determine the target parameter when a preset trigger condition is met;
[0030] A traversal check module, used for marking the fields with preset target keywords in each field in the target parameter, and traversing the unmarked fields in the target parameter to check whether each traversed field has a serialization name annotation added; the target keyword is used to identify the field that does not need to be serialized;
[0031] The exception prompt module is used to determine the fields without the serialization name annotation added in the traversed fields as abnormal fields if there are fields without the serialization name annotation added in the traversed fields, and trigger an exception prompt according to each abnormal field.
[0032] In a third aspect, the present application provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the serialization and deserialization monitoring method described in any of the above embodiments.
[0033] In a fourth aspect, the present application provides a computer device, comprising: one or more processors, and a memory;
[0034] The memory stores computer-readable instructions, and when the one or more processors execute the computer-readable instructions, the steps of the serialization and deserialization monitoring method described in any one of the above embodiments are performed.
[0035] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:
[0036] The serialization and deserialization monitoring method, device and computer equipment provided by the present application include: calling and monitoring the serialization tool class, serialization method and deserialization method, and when the preset trigger condition is met, determining the target parameter to be checked, marking the fields with preset target keywords in each field in the target parameter in order to exclude the fields that do not need to be serialized, and then traversing the unmarked fields in the target parameter to check whether the traversed fields have added serialization name annotations. If there are fields in the traversed fields that do not have the serialization name annotations added, these fields are determined as abnormal fields, and abnormal prompts are triggered according to each abnormal field. By giving abnormal prompts for fields that need to be added but have not been annotated with serialization names, developers can be reminded to handle them, so as to avoid discovering this problem in the project launch or development and testing phase, resulting in abnormalities in the business due to deserialization failure, so as to improve the level of project management and risk management. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0038] Figure 1 A flowchart of a serialization and deserialization monitoring method provided in an embodiment of the present application;
[0039] Figure 2 A schematic diagram of a process for determining target parameters provided in an embodiment of the present application;
[0040] Figure 3 A flowchart of the steps of triggering an abnormal prompt according to each abnormal field provided in an embodiment of the present application;
[0041] Figure 4 A schematic diagram of the structure of a serialization and deserialization monitoring device provided in an embodiment of the present application;
[0042] Figure 5 An internal structure diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0043] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0044] In one embodiment, the present application provides a serialization and deserialization monitoring method, and the following embodiment is described by applying the method to a server. It can be understood that the serialization and deserialization monitoring method can be performed by a single server or a server cluster composed of multiple servers, and the present application does not make specific limitations on this.
[0045] like Figure 1 As shown, the present application provides a serialization and deserialization monitoring method, the method comprising:
[0046] S101: Monitor the calls of serialization tool classes, serialization methods, and deserialization methods.
[0047] Among them, the serialization tool class refers to the class or library used in programming to convert the state of an object into a format that can be stored or transmitted, or to convert this format into an object. Generally, the serialization tool class can be defined as GsonUtil, which includes custom toJson (serialization) and fromJson (deserialization) functions. The serialization method refers to the toJson method of the Gson library, and the deserialization method refers to the fromJson method of the Gson library. Specifically, Gson is a library provided by Google for converting between objects and JSON data in the Java language.
[0048] In this step, the serialization tool class, serialization method and deserialization method are called and monitored in real time. When it is monitored that the serialization tool class is called to perform serialization or deserialization, or the serialization method or deserialization method is called, the trigger condition is met and the subsequent steps can be executed.
[0049] Furthermore, when monitoring the calls to the serialization tool class, serialization method and deserialization method, detection can be performed by setting a Hook hook, or by configuring a plug-in with related functions. This application does not impose any specific restrictions on this.
[0050] S102: When a preset trigger condition is met, a target parameter is determined.
[0051] The trigger condition refers to the trigger requirement for checking the serialization and deserialization parameters. The target parameter refers to the data class to be serialized or deserialized. The target parameter includes at least one field. In an example, the target parameter can be expressed as: data class Config(val a: Int = 0, val b: Int = 0), where a and b are fields in the target parameter Config.
[0052] In this step, when the trigger condition is met, the target parameters can be determined according to the called serialization tool class, serialization method or deserialization method.
[0053] In one embodiment, after determining the target parameters, the serialization and deserialization monitoring method further includes: querying the target parameters in a preset class name configuration table, if there is a record corresponding to the target parameters in the class name configuration table, then continuing to execute the subsequent steps of the step of determining the target parameters, if there is no record corresponding to the target parameters in the class name configuration table, then not executing the subsequent steps of the step of determining the target parameters. Among them, the class name configuration table is used to record the defined classes within the scope of the project business. Specifically, for a third-party library, in project development, it is only necessary to directly use the functions of the third library through interface calls. For the classes contained in such libraries, the serialization and deserialization monitoring methods of the present solution may not be set, and for the classes defined in its own business, the serialization and deserialization monitoring methods of the present solution may be set, so the classes defined in its own business may be added to the class name configuration table.
[0054] S103: Mark the fields with preset target keywords in each field in the target parameter, and traverse the unmarked fields in the target parameter to check whether each traversed field has a serialization name annotation added.
[0055] The target keyword is used to identify the field that does not need to be serialized. The serialized name annotation may be the @SerializedName annotation, which is used to specify a JSON attribute name for the field in the parameter that is different from the name declared in the Java code during serialization and deserialization.
[0056] In this step, in order to exclude the fields that do not need to be serialized in the target parameters, the fields with the target keywords in the target parameters are marked. These marked fields can be skipped during the subsequent traversal check, and then the unmarked fields in the target parameters are traversed. When a field is traversed, check whether the field has a serialization name annotation added, until all unmarked fields are traversed and checked.
[0057] S104: If there are fields without serialization name annotations among the traversed fields, the fields without serialization name annotations among the traversed fields are determined as abnormal fields, and abnormal prompts are triggered according to the abnormal fields.
[0058] In this step, if there are fields without serialized name annotations among the traversed fields, these fields will be identified as abnormal fields, and then abnormal prompts will be triggered according to each abnormal field to remind developers to make modifications, so as to avoid forgetting to add annotations and discovering the problem during the project launch or development and testing phase, which will affect the normal operation of the business.
[0059] Specifically, during the packaging process of the project, the fields and methods of the class will be obfuscated and optimized to reduce the package size and improve security for reasons such as reducing the package size. In this process, the name of the field may change. If the annotation of the field is omitted when writing the code, the corresponding value cannot be found by the key during deserialization, causing deserialization failure and affecting the normal operation of the business.
[0060] For example, the following description uses the Config class as the target parameter:
[0061] Assume that the class before packaging is:
[0062]
[0063] Assume that when version 1.0 is released, the packaged class obfuscation becomes:
[0064]
[0065] At this time, the original configa and configb fields are changed to a and b. Assuming that in a certain scenario, the values of a and b fields are 1 and 2 respectively, when this data is generated into json data, the json data is {"a":1, "b":2}, and this json data is saved as a string in the file. When the application of version 1.0 is released and needs to use this data again, it will first create an instance of the Config class, and then obtain all the field information of the class through reflection. According to the information of each field, it will match the key of the json data. If it matches, the value corresponding to the key will be assigned to the field. For example, for field a, it will match the key a in the json data {"a":1, "b":2} according to the character a. At this time, it is obviously possible to match, so the value 1 will be used as the value of field a. The same is true for other fields. If they cannot match in the json data, then the field will not be assigned a value in the end.
[0066] When the release version is upgraded to 2.0, it needs to be repackaged. Assume that the Config class after packaging is:
[0067]
[0068] Because the json data saved in the file when version 1.0 is released is {"a":1, "b":2}, when this data is needed in version 2.0, a Config class is also created to obtain all field information of the class. At this time, the field aa is used to match the corresponding key in the json data {"a":1, "b":2}, so the aa field cannot get the value of 1, which will affect the business logic.
[0069] If you add @SerializedName to the first class field, you can avoid this problem. For example, after adding @SerializedName("congiga") to the front of field a in the parameters of the above release version 1.0, and adding @SerializedName("congigb") to the front of field b in the parameters of the above release version 1.0, the generated json data is {"configa":1,"configb":2}. When deserializing, when matching the corresponding key according to field a, the name filled in the @SerializedName annotation of the field, that is, configa, will be obtained first. The name is used to obtain the corresponding key in the json data, so that the corresponding value of configa can be matched, and deserialization is successful. When upgrading to version 2.0, it is a similar process. The name of the @SerializedName annotation will be obtained first to match the json data, which can also be matched, thus solving the problem of deserialization failure.
[0070] However, when writing code, it is easy to forget to add the @SerializedName annotation. If this problem is discovered when the project is launched or in the development and testing phase, the impact will expand, causing abnormal business operations. By monitoring the calls to the serialization tool class, serialization method, and deserialization method, developers can be reminded by throwing exception errors, exposing the problem in advance, avoiding leaving the problem online and expanding the impact of the exception error.
[0071] The serialization and deserialization monitoring method, device and computer equipment provided by the present application include: calling and monitoring the serialization tool class, serialization method and deserialization method, and when the preset trigger condition is met, determining the target parameter to be checked, marking the fields with preset target keywords in each field in the target parameter in order to exclude the fields that do not need to be serialized, and then traversing the unmarked fields in the target parameter to check whether the traversed fields have added serialization name annotations. If there are fields in the traversed fields that do not have the serialization name annotations added, these fields are determined as abnormal fields, and abnormal prompts are triggered according to each abnormal field. By giving abnormal prompts for fields that need to be added but have not been annotated with serialization names, developers can be reminded to handle them, so as to avoid discovering this problem in the project launch or development and testing phase, resulting in abnormalities in the business due to deserialization failure, so as to improve the level of project management and risk management.
[0072] In one embodiment, the triggering condition is:
[0073] It is detected that there are parameters passed into the serialization tool class.
[0074] or,
[0075] Detects that a serialization method or a deserialization method is called.
[0076] In this embodiment, when the user calls the customized serialization method and deserialization method through the serialization tool class, the parameters that need to be serialized or deserialized will be passed in. When the server calls and monitors the serialization tool class, it can detect that there are parameters passed into the serialization tool class. In addition, if the serialization tool class is not called, but the serialization method or deserialization method of the Gson library is used directly, then only monitoring the serialization tool class cannot be detected, so the serialization method and deserialization method will also be monitored. When the user directly uses the serialization method or deserialization method of the Gson library, the server can detect that the serialization method or deserialization method is called.
[0077] It is understandable that the purpose of comprehensive monitoring of serialization and deserialization can be achieved by simultaneously monitoring the custom serialization tool class and the serialization and deserialization methods of the Gson library, thereby avoiding program business exceptions due to deserialization failures to the greatest extent and further improving the level of project management and risk management.
[0078] like Figure 2 As shown, in one embodiment, the step of determining the target parameter includes:
[0079] S201: When it is detected that a parameter is passed into the serialization tool class, the passed-in parameter is determined as a target parameter.
[0080] In this step, when the user calls the serialization tool class for serialization or deserialization, the parameters to be serialized or deserialized need to be passed in. When the server detects this action, it obtains the parameters passed into the serialization tool class and determines the obtained parameters as the target parameters.
[0081] S202: When it is monitored that a serialization method or a deserialization method is called, the called method is determined as a target method.
[0082] The target method refers to the serialization method or deserialization method of the Gson library.
[0083] S203: Convert the target method to a static method to obtain the incoming target parameter from the static method.
[0084] In this embodiment, when the user does not use a custom serialization tool class for serialization or deserialization but directly calls the serialization method or deserialization method of the Gson library, the called method can be determined as the target method, and then the target method can be converted into a static method, and then the passed in target parameters can be obtained from the static method.
[0085] Specifically, since the parameter position of the static method is fixed, there is no interference from object references. In addition, the acquisition and management of parameters can be simplified. Therefore, in this embodiment, the target parameters can be obtained conveniently and quickly by converting the target method into a static method and then obtaining the target parameters therefrom.
[0086] In one embodiment, the step of converting the target method into a static method includes:
[0087] The preset ASM library is called to modify the INVOKEVIRTUAL instruction in the code corresponding to the target method in the bytecode to an INVOKESTATIC instruction, and the target method is called with a static method to complete the conversion of the target method and obtain the static method corresponding to the target method.
[0088] Among them, the ASM library is a Java bytecode manipulation library that allows developers to directly manipulate Java bytecodes. The INVOKEVIRTUAL instruction is used to call instance methods of objects, that is, non-static methods, and the INVOKESTATIC instruction is used to call static methods.
[0089] In this step, when the source code is compiled to obtain the bytecode executed by the virtual machine, the ASM library is called to modify the INVOKEVIRTUAL instruction in the code corresponding to the target method in the bytecode, so as to obtain the target parameters through the static method obtained by conversion.
[0090] In an example, suppose that the part of the target method in the bytecode executed by the virtual machine after compiling the source code is: INVOKEVIRTUAL com / google / gson / Gson.fromJson (Ljava / lang / String;Ljava / lang / reflect / Type;)Ljava / lang / Object; at this time, the ASM library can be called to change the call to the INVOKEVIRTUAL instruction to the call to the INVOKESTATIC instruction, then the gson.fromJson call in the bytecode will be replaced by StaticGsonUtil.fromJson, a static method of the StaticGsonUtil class, as follows:
[0091]
[0092] In this way, you can get the clazz parameter in the StaticGsonUtil.fromJson method, and then get its defined fields through reflection to determine the target parameters (that is, the clazz parameter and its corresponding fields).
[0093] It is understandable that since the parameter position of the static method is fixed, there is no interference from object references. It can also simplify the acquisition and management of parameters. By modifying the call instruction in the bytecode through the ASM library, the target method can be quickly converted to a static method, thereby achieving the purpose of obtaining the target parameters conveniently and quickly.
[0094] In one embodiment, the target keyword is a transient keyword; the step of marking the fields with the preset target keyword in each field in the target parameter includes:
[0095] Iterate over each field in the target parameter and mark the field with the transient keyword when it is traversed.
[0096] Among them, the transient keyword is used to declare that member variables of a class do not need to be serialized.
[0097] It can be understood that by marking the fields with the target keyword in each field in the target parameter, the fields that do not need to be serialized are excluded from participating in the subsequent traversal inspection, thereby improving the efficiency of the monitoring inspection.
[0098] like Figure 3 As shown, in one embodiment, the step of triggering an abnormal prompt according to each abnormal field includes:
[0099] S301: According to each abnormal field, determine the code position of each abnormal field.
[0100] The code field refers to the location where the corresponding exception field is defined.
[0101] In this step, the code position of each abnormal field is determined according to the determined abnormal fields.
[0102] S302: According to the code position of each abnormal field, respectively determine the jump link corresponding to the code position of each abnormal field.
[0103] A jump link refers to a link that can directly jump to a corresponding code location by accessing it.
[0104] In this step, a corresponding jump link can be set at the code position of each exception field. In this way, when an exception error is thrown, the jump link of each exception field can be carried. Developers can not only know the occurrence of the exception error in time, but also access the jump link by clicking to directly jump to the location defined by the exception field, which is convenient for developers to modify the exception field to eliminate the exception error.
[0105] S303: Generate exception information of each exception field according to the jump link corresponding to the code position of each exception field, and throw the exception information of each exception field.
[0106] The exception information includes but is not limited to exception fields, jump links, error type identifiers, etc.
[0107] In this step, the exception information of each exception field can be generated by the jump link corresponding to the code position of each exception field and collecting other data. Then the generated exception information is thrown out so that the exception information is displayed on the front-end page, which can remind developers to check the exception field in time and add serialization name annotations to the exception field to avoid discovering this problem in the project launch or development and testing phase, resulting in business exceptions due to deserialization failure, so as to improve the level of project management and risk management.
[0108] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0109] The serialization and deserialization monitoring device provided in an embodiment of the present application is described below. The serialization and deserialization monitoring device described below and the serialization and deserialization monitoring method described above can be referenced to each other.
[0110] like Figure 4 As shown, the present application provides a serialization and deserialization monitoring device 400, the device comprising:
[0111] A call monitoring module 401 is used to monitor the calls of serialization tool classes, serialization methods, and deserialization methods;
[0112] The parameter determination module 402 is used to determine the target parameter when a preset trigger condition is met;
[0113] The traversal check module 403 is used to mark the fields with preset target keywords in each field in the target parameter, and traverse the unmarked fields in the target parameter to check whether each traversed field has a serialization name annotation added; the target keyword is used to identify the field that does not need to be serialized;
[0114] The exception prompt module 404 is used to determine the fields without serialization name annotation added as abnormal fields if there are fields without serialization name annotation added in the traversed fields, and trigger abnormal prompts according to the abnormal fields.
[0115] In one embodiment, the parameter determination module includes: a trigger condition is:
[0116] It is detected that there are parameters passed into the serialization tool class.
[0117] or,
[0118] Detects that a serialization method or a deserialization method is called.
[0119] In one embodiment, the parameter determination module includes:
[0120] The first determination submodule is used to determine the passed-in parameters as target parameters when it is detected that there are parameters passed into the serialization tool class.
[0121] In one embodiment, the parameter determination module includes:
[0122] The second determination submodule is used to determine the called method as the target method when monitoring that the serialization method or the deserialization method is called;
[0123] The third determination submodule is used to convert the target method into a static method to obtain the incoming target parameters from the static method.
[0124] In one embodiment, the third determining submodule includes:
[0125] The instruction modification unit is used to call the preset ASM library to modify the INVOKEVIRTUAL instruction in the code corresponding to the target method in the bytecode into an INVOKESTATIC instruction, call the target method with a static method to complete the conversion of the target method, and obtain the static method corresponding to the target method.
[0126] In one embodiment, the target keyword is a transient keyword; the traversal check module includes:
[0127] The traversal submodule is used to traverse each field in the target parameter. When a field with the transient keyword is traversed, the field is marked.
[0128] In one embodiment, the abnormality prompt module includes:
[0129] A position determination submodule is used to determine the code position of each abnormal field according to each abnormal field;
[0130] The link determination submodule is used to determine the jump link corresponding to the code position of each abnormal field according to the code position of each abnormal field;
[0131] The exception throwing submodule is used to generate the exception information of each exception field according to the jump link corresponding to the code position of each exception field, and throw the exception information of each exception field.
[0132] The division of each module in the above-mentioned serialization and deserialization monitoring device is only for illustration. In other embodiments, the serialization and deserialization monitoring device can be divided into different modules as needed to complete all or part of the functions of the above-mentioned serialization and deserialization monitoring device. Each module in the above-mentioned serialization and deserialization monitoring device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
[0133] In one embodiment, the present application also provides a storage medium, which stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the serialization and deserialization monitoring method as described in any of the above embodiments.
[0134] In one embodiment, the present application also provides a computer device having computer-readable instructions stored therein. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the serialization and deserialization monitoring method as described in any one of the above embodiments.
[0135] Indicatively, Figure 5 As shown, Figure 5 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. The computer device 500 may be provided as a server. Figure 5 , the computer device 500 includes a processing component 502, which further includes one or more processors, and a memory resource represented by a memory 501, for storing instructions that can be executed by the processing component 502, such as an application. The application stored in the memory 501 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 502 is configured to execute instructions to perform the serialization and deserialization monitoring method of any of the above embodiments.
[0136] The computer device 500 may further include a power supply component 503 configured to perform power management of the computer device 500, a wired or wireless network interface 504 configured to connect the computer device 500 to a network, and an input / output (I / O) interface 505. The computer device 500 may operate based on an operating system stored in the memory 501, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, Free BSD TM, or the like.
[0137] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0138] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish an entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only include those elements, but also include other elements that are not clearly listed, or also include elements inherent to such process, method, article or equipment. In the absence of more restrictions, the elements limited by the sentence "comprise one..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements. Herein, the singular "one", "one" and "described / the" may also include plural forms, unless the context clearly indicates another way. It should also be understood that the terms "include / comprise" or "have" etc. specify the existence of stated features, wholes, steps, operations, components, parts or combinations thereof, but do not exclude the possibility of the existence or addition of one or more other features, wholes, steps, operations, components, parts or combinations thereof. At the same time, the term "and / or" used in this specification includes any and all combinations of the relevant listed items.
[0139] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can refer to each other.
[0140] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A serialization and deserialization monitoring method, characterized in that: The method comprises: Monitor the calls to serialization tool classes, serialization methods, and deserialization methods; When the preset trigger conditions are met, the target parameters are determined; Marking the fields with preset target keywords in each field in the target parameter, and traversing the unmarked fields in the target parameter to check whether each traversed field has a serialization name annotation added; the target keyword is used to identify the field that does not need to be serialized; If there are fields without the serialization name annotation added in the traversed fields, the fields without the serialization name annotation added in the traversed fields are determined as abnormal fields, and abnormal prompts are triggered according to the abnormal fields.
2. The serialization and deserialization monitoring method according to claim 1, characterized in that: The trigger conditions are: It is detected that there are parameters passed into the serialization tool class. or, It is detected that the serialization method or the deserialization method is called.
3. The serialization and deserialization monitoring method according to claim 1 or 2, characterized in that: The step of determining the target parameter comprises: When it is detected that there are parameters passed into the serialization tool class, the passed-in parameters are determined as target parameters.
4. The serialization and deserialization monitoring method according to claim 1 or 2, characterized in that: The step of determining the target parameter comprises: When it is detected that the serialization method or the deserialization method is called, the called method is determined as a target method; The target method is converted into a static method to obtain the passed-in target parameter from the static method.
5. The serialization and deserialization monitoring method according to claim 4, characterized in that: The step of converting the target method into a static method comprises: The preset ASM library is called to modify the INVOKEVIRTUAL instruction in the code corresponding to the target method in the bytecode into an INVOKESTATIC instruction, and the target method is called by a static method to complete the conversion of the target method and obtain the static method corresponding to the target method.
6. The serialization and deserialization monitoring method according to claim 1, characterized in that: The target keyword is a transient keyword; The step of marking the fields with preset target keywords in each field in the target parameter includes: Each field in the target parameter is traversed, and when a field with the transient keyword is traversed, the field is marked.
7. The serialization and deserialization monitoring method according to claim 1, characterized in that: The step of triggering an abnormal prompt according to each abnormal field includes: According to each abnormal field, determine the code position of each abnormal field; According to the code position of each abnormal field, the jump link corresponding to the code position of each abnormal field is determined respectively; According to the jump link corresponding to the code position of each exception field, the exception information of each exception field is generated, and the exception information of each exception field is thrown.
8. A serialization and deserialization monitoring device, characterized in that: The device comprises: The call monitoring module is used to monitor the calls of serialization tool classes, serialization methods, and deserialization methods; A parameter determination module, used to determine the target parameter when a preset trigger condition is met; A traversal check module, used for marking the fields with preset target keywords in each field in the target parameter, and traversing the unmarked fields in the target parameter to check whether each traversed field has a serialization name annotation added; the target keyword is used to identify the field that does not need to be serialized; The exception prompt module is used to determine the fields without the serialization name annotation added in the traversed fields as abnormal fields if there are fields without the serialization name annotation added in the traversed fields, and trigger an exception prompt according to each abnormal field.
9. A storage medium, characterized in that: The storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the serialization and deserialization monitoring method as described in any one of claims 1 to 7.
10. A computer device, characterized in that: include: one or more processors, and memory; The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the serialization and deserialization monitoring method as described in any one of claims 1 to 7 are performed.