Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
java-deserialization
Advanced tools
Parse Java object serialization format using pure JavaScript
This package started out with the hope of satisfying some specific need for a given project. The first version was committed once that need was satisfied. So far, it makes no claims of completeness or correctness. But if you need to deserialize some Java objects using JavaScript, then you might prefer building on that over starting from scratch.
var javaDeserialization = require("java-deserialization");
var objects = javaDeserialization.parse(buf);
Each object in objects
will contain the values of its “normal”
fields as properties, and two hidden properties.
One is called class
and represents the class of the object,
with super
pointing at its parent class.
The other is extends
which is a map from fully qualified class names
to the fields associated with that class.
If one wants to inspect the private field of some specific class,
using extends
will help in cases where a more derived class contains
another field of the same name.
The names class
and extends
were deliberately chosen in such a way
that they are keywords in Java and won't occur in normal field names.
The properties are non-enumerable, so they won't show up in enumerations
and e.g. util.inspect
won't show them by default.
If the class contained custom serialization code,
the output from that is collected in a special property called @
.
One can write post-processing code to reformat the data from that list.
Such code has already been added for the following types:
java.util.ArrayList
– extracts a list
field which is an ES Arrayjava.util.ArrayDeque
– extracts a list
fieldjava.util.Hashtable
– extracts a map
field which is an ES6 Map
and an obj
for String
-valued keysjava.util.HashMap
– map
and obj
just as Hashtable
java.util.EnumMap
– map
and obj
, the latter with enum
constant names as keysjava.util.HashSet
– extracts a set
field which is an ES6 SetBug reports, suggestions, code contributions and the likes should go to the project's GitHub page.
FAQs
Parse Java object serialization format using pure JavaScript
The npm package java-deserialization receives a total of 64 weekly downloads. As such, java-deserialization popularity was classified as not popular.
We found that java-deserialization demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.