如何防止单例模式被JAVA反射攻击
<p>单例模式相信大家都知道,用过的人不在少数。之前写过一篇博文《singleton模式四种线程安全的实现》(参见:http://blog.csdn.NET/u013256816/article/details/50427061),讲诉了单例模式的四种写法,并指出占位符模式的写法比较ok,详见如下:</p> <pre> <code class="language-java">package com.effective.singleton; public class Elvis { private static boolean flag = false; private Elvis(){ } private static class SingletonHolder{ private static final Elvis INSTANCE = new Elvis(); } public static Elvis getInstance() { return SingletonHolder.INSTANCE; } public void doSomethingElse() { } }</code></pre> <p>但这都是基于一个条件:确保不会通过反射机制调用私有的构造器。</p> <p>这里举个例子,通过JAVA的反射机制来“攻击”单例模式:</p> <pre> <code class="language-java">package com.effective.singleton; import java.lang.reflect.Constructor; import java.lang.reflect.InvocationTargetException; public class ElvisReflectAttack { public static void main(String[] args) throws InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException, NoSuchMethodException, SecurityException { Class<?> classType = Elvis.class; Constructor<?> c = classType.getDeclaredConstructor(null); c.setAccessible(true); Elvis e1 = (Elvis)c.newInstance(); Elvis e2 = Elvis.getInstance(); System.out.println(e1==e2); } }</code></pre> <p>运行结果:false</p> <p>可以看到,通过反射获取构造函数,然后调用setAccessible(true)就可以调用私有的构造函数,所有e1和e2是两个不同的对象。</p> <p>如果要抵御这种攻击,可以修改构造器,让它在被要求创建第二个实例的时候抛出异常。</p> <p>经修改后:</p> <pre> <code class="language-java">package com.effective.singleton; public class ElvisModified { private static boolean flag = false; private ElvisModified(){ synchronized(ElvisModified.class) { if(flag == false) { flag = !flag; } else { throw new RuntimeException("单例模式被侵犯!"); } } } private static class SingletonHolder{ private static final ElvisModified INSTANCE = new ElvisModified(); } public static ElvisModified getInstance() { return SingletonHolder.INSTANCE; } public void doSomethingElse() { } }</code></pre> <p>测试代码:</p> <pre> <code class="language-java">package com.effective.singleton; import java.lang.reflect.Constructor; public class ElvisModifiedReflectAttack { public static void main(String[] args) { try { Class<ElvisModified> classType = ElvisModified.class; Constructor<ElvisModified> c = classType.getDeclaredConstructor(null); c.setAccessible(true); ElvisModified e1 = (ElvisModified)c.newInstance(); ElvisModified e2 = ElvisModified.getInstance(); System.out.println(e1==e2); } catch (Exception e) { e.printStackTrace(); } } }</code></pre> <p>运行结果:</p> <pre> <code class="language-java">Exception in thread "main" java.lang.ExceptionInInitializerError at com.effective.singleton.ElvisModified.getInstance(ElvisModified.java:27) at com.effective.singleton.ElvisModifiedReflectAttack.main(ElvisModifiedReflectAttack.java:17) Caused by: java.lang.RuntimeException: 单例模式被侵犯! at com.effective.singleton.ElvisModified.<init>(ElvisModified.java:16) at com.effective.singleton.ElvisModified.<init>(ElvisModified.java:7) at com.effective.singleton.ElvisModified$SingletonHolder.<clinit>(ElvisModified.java:22) ... 2 more</code></pre> <p>可以看到,成功的阻止了单例模式被破坏。</p> <p>从JDK1.5开始,实现Singleton还有新的写法,只需编写一个包含单个元素的枚举类型。推荐写法:</p> <pre> <code class="language-java">package com.effective.singleton; public enum SingletonClass { INSTANCE; public void test() { System.out.println("The Test!"); } }</code></pre> <p>测试代码:</p> <pre> <code class="language-java">package com.effective; import java.lang.reflect.Constructor; import java.lang.reflect.InvocationTargetException; import com.effective.singleton.SingletonClass; public class TestMain { public static void main(String[] args) throws NoSuchMethodException, SecurityException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { Class<SingletonClass> classType = SingletonClass.class; Constructor<SingletonClass> c = (Constructor<SingletonClass>) classType.getDeclaredConstructor(); c.setAccessible(true); c.newInstance(); } }</code></pre> <p>运行结果:</p> <pre> <code class="language-java">Exception in thread "main" java.lang.NoSuchMethodException: com.effective.singleton.SingletonClass.<init>() at java.lang.Class.getConstructor0(Unknown Source) at java.lang.Class.getDeclaredConstructor(Unknown Source) at com.effective.TestMain.main(TestMain.java:22)</code></pre> <p>由此可见这种写法也可以防止单例模式被“攻击”。</p> <p>而且这种写法也可以防止序列化破坏单例模式,具体不在举例了,有关序列化以及单例模式被序列化破坏可以参考博文《JAVA序列化》(链接:http://blog.csdn.net/u013256816/article/details/50474678)。</p> <p>单元素的枚举类型已经成为实现Singleton模式的最佳方法。</p> <p> </p> <p>来自:http://www.importnew.com/22493.html</p> <p> </p>
本文由用户 shimuxi 自行上传分享,仅供网友学习交流。所有权归原作者,若您的权利被侵害,请联系管理员。
转载本站原创文章,请注明出处,并保留原始链接、图片水印。
本站是一个以用户分享为主的开源技术平台,欢迎各类分享!