Gson，无法序列化/反序列化类类型

Question

I've got a class like this:

public class A {
    @serializedName("type")
    Class<?> type;
...
}

But when I tried to serialize it I get an error saying "Attempt to serialize java.lang.class: java.lang.String. Forgot to register a TypeAdapter?". So I created this adapter:

public class MyTypeAdapter extends TypeAdapter<Class> {
public Class read(JsonReader in) throws IOException {
    if (in.peek() == JsonToken.NULL) {
        in.nextNull();
        return null;
    } else {
        String className = in.nextString();
        try {
            return Class.forName(className);
        } catch (ClassNotFoundException e) {
            throw new JsonParseException("class " + className + " not found");
        }
    }
}

public void write(JsonWriter out, Class value) throws IOException {
    if (value == null) {
        out.nullValue();
    } else {
        out.value(value.getName());
    }
}

}

And registered it like this:

new GsonBuilder().registerTypeAdapter(Class.class, new MyTypeAdapter ()).create().
fromJson(value, listType);

But I'm still getting the same error.
What am I doing wrong?
Does the implementation of the adapter look ok?

Answer 1

What am I doing wrong?

Gson takes type information into account: you're trying to mix Class and Class<?> that are different types representing a raw type and a wildcard-parameterized type respectively. From this perspective, Gson does not consider Class (found in your registerTypeAdapter ) and Class<?> (found in your DTOs) equivalent. For this case you have to register the type hierarchy adapter with registerTypeHierarchyAdapter .

Does the implementation of the adapter look ok?

Yes, but it can be improved slightly:

final class ClassTypeAdapter
        extends TypeAdapter<Class<?>> {

    // The type adapter does not hold state, so it can be easily made singleton (+ making the constructor private)
    private static final TypeAdapter<Class<?>> instance = new ClassTypeAdapter()
            // This is a convenient method that can do trivial null-checks in write(...)/read(...) itself
            .nullSafe();

    private ClassTypeAdapter() {
    }

    static TypeAdapter<Class<?>> get() {
        return instance;
    }

    @Override
    public void write(final JsonWriter out, final Class<?> value)
            throws IOException {
        // value is never a null here
        out.value(value.getName());
    }

    @Override
    public Class<?> read(final JsonReader in)
            throws IOException {
        try {
            // This will never be a null since nullSafe() is used above
            final String className = in.nextString();
            return Class.forName(className);
        } catch ( final ClassNotFoundException ex ) {
            // No need to duplicate the message generated in ClassNotFoundException
            throw new JsonParseException(ex);
        }
    }

}

As it's said by @Daniel Pryden , this is potentially a huge security issue, because Class.forName may execute code (static initializers). You should check the className against the classes whitelist before Class.forName(...) is executed. Also note that Class instances do not hold type parameterization (please see what TypeToken s and ParameterizedType s are for) and you might want to encode the type with all of its type parameterization (easy to toString(...) but not that easy to parse though - I faced such an issue once and resolved it by implementing a parser in JParsec).