單例模式的實現方式及如何有效防止防止反射和反序列化

本文轉載自查看原文 2019-07-11 18:18 1605 設計模式隨筆

方式一：餓漢式(靜態常量)

public class Singleton {
    
    private final static Singleton SINGLETON = new Singleton();
    
    private Singleton(){
    }
    
    public void doAction(){
        //TODO 實現你需要做的事
    }
    
    public static Singleton getInstance(){
        return SINGLETON;
    }
}

測試用例:

public class Test {
    public static void main(String[] args) {
        Signleton singleton1 = Singleton.getInstance();
        Signleton singleton2 = Singleton.getInstance();
        
        System.out.println("兩個singleton對象是否是同一個對象:"+ (singleton1 == singleton2) );
        System.out.println("singleton1的hashCode:"+singleton1.hashCode());
        System.out.println("singleton2的hashCode:"+singleton2.hashCode());
    }
}

運行結果:

兩個singleton對象是否是同一個對象:true
singleton1的hashCode:366712642
singleton2的hashCode:366712642

優點：

代碼實現簡單
利用類加載機制避免了多線程同步問題

缺點：

在類加載時就完成了實例化，沒有達到Lazy loading的效果，有可能造成內存浪費

方式二：餓漢式(靜態代碼塊)

public class Singleton {
    
    private final static Singleton SINGLETON;
    static{
        SINGLETON = new Singleton();
    }
    
    private Singleton(){
    }
    public void doAction(){
        //TODO 實現你需要做的事
    }
    
    public static Singleton getInstance(){
        return SINGLETON;
    }
}

測試用例：

public class Test {
    public static void main(String[] args) {
        Signleton singleton1 = Singleton.getInstance();
        Signleton singleton2 = Singleton.getInstance();
        
        System.out.println("兩個singleton對象是否是同一個對象:"+ (singleton1 == singleton2) );
        System.out.println("singleton1的hashCode:"+singleton1.hashCode());
        System.out.println("singleton2的hashCode:"+singleton2.hashCode());
    }
}

運行結果：

兩個singleton對象是否是同一個對象:true
singleton1的hashCode:366712642
singleton2的hashCode:366712642

這種實現方式優缺點和方式一是一樣的，也是利用了類加載，唯一不同的就是將實例化的過程放在了靜態代碼塊中。

方式三：懶漢式(線程不安全)

public class Singleton {

    private static Singleton singleton;
    private Singleton(){
    }
    public void doAction(){
        //TODO 實現你需要做的事
    }
    
    public static Singleton getInstance(){
        if (singleton == null) {
            singleton = new Singleton();
        }
        return singleton;
    }
}

測試代碼：

public class Test {
    public static void main(String[] args) {
        //多線程獲取對象，存在線程不安全問題
        Thread thread1 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton1 = Singleton.getInstance();
                System.out.println("singleton1的hashCode:"+singleton1.hashCode());
            }
        });
        Thread thread2 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton2 = Singleton.getInstance();
                System.out.println("singleton2的hashCode:"+singleton2.hashCode());
            }
        });
        thread1.start();
        thread2.start();
    }
}

運行結果：

第一次運行結果:
    singleton2的hashCode:1813990537
    singleton1的hashCode:1813990537
第二次運行結果:
    singleton1的hashCode:1813990537
    singleton2的hashCode:1481479505

從兩次運行結果來看，我們發現singleton1與singleton2的hashCode存在相同和不想同的兩種情況，這就已經證明了這種方式的線程不安全性

優點:

起到了Lazy loading效果，適合在單線程環境中使用

缺點:

在多線程環境中存在線程不安全問題

方式四：懶漢式(方法同步)

public class Singleton {
    private static Singleton singleton;

    private Singleton(){
    }
    public void doAction(){
        //TODO 實現你需要做的事
    }
    public synchronized static Singleton getInstance(){
        if (singleton == null) {
            singleton = new Singleton();
        }
        return singleton;
    }
}

測試用例(可多做幾次測試)：

public class Test {
    public static void main(String[] args) {
        //多線程獲取對象，線程安全問題
        Thread thread1 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton1 = Singleton.getInstance();
                System.out.println("singleton1的hashCode:"+singleton1.hashCode());
            }
        });
        Thread thread2 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton2 = Singleton.getInstance();
                System.out.println("singleton2的hashCode:"+singleton2.hashCode());
            }
        });
        thread1.start();
        thread2.start();
    }
}

運行結果：

第一次運行結果:
    singleton1的hashCode:1947425526
    singleton2的hashCode:1947425526
第二次運行結果:
    singleton1的hashCode:1430007319
    singleton2的hashCode:1430007319

從兩次運行結果來看，我們發現singleton1與singleton2的hashCode是一樣的，說明這種方法是線程安全的

優點：

實現了Lazy loading想過
避免了多線程同步問題

缺點：

效率太低，每個線程在執行getInstance()方法都要進行同步。實際上這個方法只要執行一次實例化就行，當實例化完成，后面的線程是通不過if判斷的

方式五：懶漢式(實例化代碼同步)

public class Singleton {
    private static Singleton singleton;
    
    public Singleton() {
    }
    public void doAction(){
        //TODO 實現你需要做的事
    }
    public  static Singleton getInstance(){
        if (singleton == null) {
            synchronized (Singleton.class) {
                singleton = new Singleton();
            }
        }
        return singleton;
    }
}

測試用例：

public class Test {
    public static void main(String[] args) {
        //多線程獲取對象，存在線程不安全問題
        Thread thread1 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton1 = Singleton.getInstance();
                System.out.println("singleton1的hashCode:"+singleton1.hashCode());
            }
        });
        Thread thread2 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton2 = Singleton.getInstance();
                System.out.println("singleton2的hashCode:"+singleton2.hashCode());
            }
        });
        thread1.start();
        thread2.start();
    }
}

運行結果：

singleton2的hashCode:1813990537
singleton1的hashCode:1430007319

從兩次運行結果來看，我們發現singleton1與singleton2的hashCode是不相同的，證明這種方式是線程不安全的

有點：

實現了Lazy loading的現過
相對於第四種的同步，該方法的效率得到了提升

缺點：

在多線程環境中存在線程不安全問題

方式六：雙重檢測

public class Singleton {
    private static Singleton singleton;
    
    private Singleton(){
    }
    public void doAction(){
        //TODO 實現你需要做的事
    }
    public  static Singleton getInstance(){
        if (singleton == null) {
            synchronized (Singleton.class) {
                if (singleton == null) {
                    singleton = new Singleton();
                }
            }
        }
        return singleton;
    }
}

測試用例：

public class Test {
    public static void main(String[] args) {
        //多線程獲取對象，線程安全
        Thread thread1 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton1 = Singleton.getInstance();
                System.out.println("singleton1的hashCode:"+singleton1.hashCode());
            }
        });
        Thread thread2 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton2 = Singleton.getInstance();
                System.out.println("singleton2的hashCode:"+singleton2.hashCode());
            }
        });
        thread1.start();
        thread2.start();
    }
}

運行結果：

singleton2的hashCode:1481479505
singleton1的hashCode:1481479505

優點：

線程安全
實現Lazy loading
效率較高

方式七：靜態內部類

public class Singleton {
    public Singleton() {
    }
    public void doAction(){
        //TODO 實現你需要做的事
    }
    private static class SingletonInstance{
        private final static Singleton SINGLETON = new Singleton();
    }
    public  static Singleton getInstance(){
        return SingletonInstance.SINGLETON;
    }
}

測試用例:

public class Test {
    public static void main(String[] args) {
        //多線程獲取對象，線程安全
        Thread thread1 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton1 = Singleton.getInstance();
                System.out.println("singleton1的hashCode:"+singleton1.hashCode());
            }
        });
        Thread thread2 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton2 = Singleton.getInstance();
                System.out.println("singleton2的hashCode:"+singleton2.hashCode());
            }
        });
        thread1.start();
        thread2.start();
    }
}

運行結果：

singleton2的hashCode:1481479505
singleton1的hashCode:1481479505

這種方式利用了類裝載機制來保證初始化實例時只有一個線程，靜態內部類在Singleton被裝載時並不會立即實例化，而是在調用getInstance()時才會裝載靜態內部類，從而完成Singleton實例化。由於類的靜態屬性只會在第一次加載類的時候進行初始化，這里我們通過JVM加載類時的線程安全的特性來保證了線程安全

優點：

利用JVM加載靜態內部類的機制保證多線程安全
實現Lazy loading效果
效率高

方式八：使用枚舉(《Effective Java》作者的Josh Bloch提倡的方式)

public enum Singleton {
    INSTANCE;
    public void doAction(){
        //TODO 實現你需要做的事
    }
}

測試用例：

public class Test {
    public static void main(String[] args) {
        //多線程獲取對象，線程安全
        Thread thread1 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton1 = Singleton.INSTANCE;
                System.out.println("singleton1的hashCode:"+singleton1.hashCode());
            }
        });
        Thread thread2 = new Thread(new Runnable() {
            public void run() {
                Singleton singleton2 = Singleton.INSTANCE;
                System.out.println("singleton2的hashCode:"+singleton2.hashCode());
            }
        });
        thread1.start();
        thread2.start();
    }
}

運行結果：

singleton2的hashCode:321306952
singleton1的hashCode:321306952

優點：

線程安全(枚舉實例的創建默認就是線程安全的)
不會因為序列化而產生新實例
防止反射攻擊

破環單例模式的三種方式：反射，序列化，克隆

以雙重檢測方式為例測試反射，序列化，克隆是否能破環單例模式:

public class Singleton  implements Serializable,Cloneable{
    private static final long serialVersionUID = 6125990676610180062L;
    private static Singleton singleton;
    
    private Singleton(){
    }
    public void doAction(){
        //TODO 實現你需要做的事
    }
    public  static Singleton getInstance(){
        if (singleton == null) {
            synchronized (Singleton.class) {
                if (singleton == null) {
                    singleton = new Singleton();
                }
            }
        }
        return singleton;
    }
    @Override
    protected Object clone() throws CloneNotSupportedException {
        return super.clone();
    }
}

測試用例：

public class DestroySingleton {
    
    public static void main(String[] args) throws Exception {
        //通過getInstance()獲取
        Singleton singleton = Singleton.getInstance();
        System.out.println("singleton的hashCode:"+singleton.hashCode());
        //通過反射獲取
        Constructor<Singleton> constructor = Singleton.class.getDeclaredConstructor();
        constructor.setAccessible(true);
        Singleton reflex = constructor.newInstance();
        System.out.println("reflex的hashCode:"+reflex.hashCode());
        //通過克隆獲取
        Singleton clob = (Singleton) Singleton.getInstance().clone();
        System.out.println("clob的hashCode:"+clob.hashCode());
        //通過序列化，反序列化獲取
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(bos);
        oos.writeObject(Singleton.getInstance());
        ByteArrayInputStream bis = new ByteArrayInputStream(bos.toByteArray());
        ObjectInputStream ois = new ObjectInputStream(bis);
        Singleton serialize = (Singleton) ois.readObject();
        if (ois != null)    ois.close();
        if (bis != null) bis.close();
        if (oos != null) oos.close();
        if (bos != null) bos.close();
        System.out.println("serialize的hashCode:"+serialize.hashCode());
    }
}

運行結果：

singleton的hashCode:366712642
reflex的hashCode:1829164700
clob的hashCode:2018699554
serialize的hashCode:990368553

運行結果表明通過getInstance()、反射、克隆、序列化這四種方式得到的Singleton對象的hashCode是不一樣的，此時單例模式已然被破環

如何防止反射、克隆、序列化對單例模式的破環

1、防止反射破環(雖然構造方法已私有化，但通過反射機制使用newInstance()方法構造方法也是可以被調用):

首先定義一個全局變量開關isFristCreate默認為開啟狀態
當第一次加載時將其狀態更改為關閉狀態

2、防止克隆破環

重寫clone()，直接返回單例對象

3、防止序列化破環

添加readResolve()，返回Object對象

public class Singleton  implements Serializable,Cloneable{
    private static final long serialVersionUID = 6125990676610180062L;
    private static Singleton singleton;
    private static boolean isFristCreate = true;//默認是第一次創建
    
    private Singleton(){
            if (isFristCreate) {
                synchronized (Singleton.class) {
　　　　　　　　　　　　if (isFristCreate) {
　　　　　　　　　　　　　　isFristCreate = false;
　　　　　　　　　　　　}
                }
            }else{
                throw new RuntimeException("已然被實例化一次，不能在實例化");
            }
    }
    public void doAction(){
        //TODO 實現你需要做的事
    }
    public  static Singleton getInstance(){
        if (singleton == null) {
            synchronized (Singleton.class) {
                if (singleton == null) {
                    singleton = new Singleton();
                }
            }
        }
        return singleton;
    }
    @Override
    protected Singleton clone() throws CloneNotSupportedException {
        return singleton;
    }
    private Object readResolve() {
        return singleton;
    }
}

測試用例：

public class DestroySingleton {
    
    public static void main(String[] args) throws Exception {
        //通過getInstance()獲取
        Singleton singleton = Singleton.getInstance();
        System.out.println("singleton的hashCode:"+singleton.hashCode());
        //通過克隆獲取
        Singleton clob = (Singleton) Singleton.getInstance().clone();
        System.out.println("clob的hashCode:"+clob.hashCode());
        //通過序列化，反序列化獲取
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(bos);
        oos.writeObject(Singleton.getInstance());
        ByteArrayInputStream bis = new ByteArrayInputStream(bos.toByteArray());
        ObjectInputStream ois = new ObjectInputStream(bis);
        Singleton serialize = (Singleton) ois.readObject();
        if (ois != null)    ois.close();
        if (bis != null) bis.close();
        if (oos != null) oos.close();
        if (bos != null) bos.close();
        System.out.println("serialize的hashCode:"+serialize.hashCode());
        //通過反射獲取
        Constructor<Singleton> constructor = Singleton.class.getDeclaredConstructor();
        constructor.setAccessible(true);
        Singleton reflex = constructor.newInstance();
        System.out.println("reflex的hashCode:"+reflex.hashCode());
    }
}

運行結果：

singleton的hashCode:366712642
clob的hashCode:366712642
serialize的hashCode:366712642
Exception in thread "main" java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at designPatterns.singleton.doublecheck.DestroySingleton.main(DestroySingleton.java:33)
Caused by: java.lang.RuntimeException: 已然被實例化一次，不能在實例化
    at designPatterns.singleton.doublecheck.Singleton.<init>(Singleton.java:16)
    ... 5 more

從運行結果上看重寫clone()，添加readResolve()后通過克隆和序列化得到的對象的hashCode與從getInstance()得到的對象得而hashCode值相同，而通過反射運行得到的結果符合預想的報錯；因為以上三種手段對防止單例被破壞起作用了，至於枚舉為什么能做到防止反射，克隆及序列化對單例的破壞將留在下次分享

　　如有寫的不對的地方請書友們及時指出，謹誠拜謝！！

免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。

猜您在找 單例模式的漏洞，通過反射和序列化、反序列化來破解單例，以及如何避免這些漏洞 java反序列化漏洞（1）之反射機制什么是序列化和反序列化？實體類為什么要實現序列化？ java~jackson實現接口的反序列化 python中的load、loads實現反序列化 kafka自定義消息序列化和反序列化方式 Json 序列化以及反序列化的三種方式（二）序列化和反序列化的幾種方式(DataContractSerializer)（二）使用HttpMessageConverter實現HTTP的序列化和反序列化 xstream實現對象的序列化和反序列化（Java）