Java

Java

Made by DeepSource

Serializable class with non-serializable superclass and no default constructor detected JAVA-E1034

Bug risk
Major

This serializable class has a non-serializable superclass that does not declare a default constructor. Deserializing such a class will fail with an InvalidClassException because Java will not be able to instantiate it.

Java's Serializable interface enforces specific requirements on serializable classes that extend a non-serializable class:

To allow subtypes of non-serializable classes to be serialized, the subtype may assume responsibility for saving and restoring the state of the supertype's public, protected, and (if accessible) package fields. The subtype may assume this responsibility only if the class it extends has an accessible no-arg constructor to initialize the class's state. It is an error to declare a class Serializable if this is not the case. The error will be detected at runtime.

Put simply, given the following conditions:

  1. The class implements Serializable.
  2. The class extends a non-serializable class.
  3. The superclass does not define a no-argument (default) constructor.

Java will throw an InvalidClassException when attempting to deserialize an instance of the class.

Bad Practice

class SuperClass {
    int x;
    public SuperClass(int a) {
        x = a;
    }
}

// Java will fail to deserialize this class.
class SubClass extends SuperClass implements Serializable {
    // ...
}

Recommended

class SuperClass {
    int x;
    public SuperClass(int a) {
        x = a;
    }

    public SuperClass() {
        x = 0;
    }
}

class SubClass extends SuperClass implements Serializable {
    // ...
}

References