java - 如何使用 JSON-B 将 JSON 字符串反序列化为非公共(public)类？

Question

我创建了一个简单的 Java 9 Maven 应用程序，其中包含两个类，用于使用 JSON-B 测试 JSON 的序列化和反序列化。这是代码:

package com.jsonbdemos;
import javax.json.bind.Jsonb;
import javax.json.bind.JsonbBuilder;
import javax.json.bind.JsonbConfig;

public class App {

    public static void main(String[] args) {
        Jsonb jsonb = JsonbBuilder.create(new JsonbConfig());
        String jsonData = "{\"creationDate\":\"2018-01-05\"}";

        // Create Widget object from JSON string.
        Widget widget = jsonb.fromJson(jsonData, Widget.class);
        System.out.println("JSON => object: " + widget.toString());

        // Serialize Widget object to JSON string.
        String jsonFromObject = jsonb.toJson(widget);
        System.out.println("object => JSON: " + jsonFromObject);
    }
}

package com.jsonbdemos;
import java.time.LocalDate;

public class Widget { // IllegalAccessException if "public" is removed.
    private LocalDate creationDate;
    public Widget() {}

    @Override
    public String toString() { return "creationDate=" + creationDate; }
    public LocalDate getCreationDate() { return creationDate; }
    public void setCreationDate(LocalDate creationDate) { this.creationDate = creationDate; }
}

pom.xml 中存在对最新版本的 JSON-B 引用实现 (Eclipse Yasson) 的依赖:

<dependency>
  <groupId>org.glassfish</groupId>
  <artifactId>javax.json</artifactId>
  <version>[1.1.2,)</version>
</dependency>
<dependency>
  <groupId>javax.json.bind</groupId>
  <artifactId>javax.json.bind-api</artifactId>
  <version>[1.0,)</version>
</dependency>
<dependency>
  <groupId>org.eclipse</groupId>
  <artifactId>yasson</artifactId>
  <version>[1.0.0,)</version>
</dependency>

应用程序运行良好，但如果我将类 Widget 的访问级别从 public 更改为无(即“package private”)调用 Jsonb.fromJson() 时抛出 IllegalAccessException:

Exception in thread "main" javax.json.bind.JsonbException: Can't create instance at org.eclipse.yasson.internal.ReflectionUtils.lambda$createNoArgConstructorInstance$1(ReflectionUtils.java:191) at java.base/java.security.AccessController.doPrivileged(Native Method) at org.eclipse.yasson.internal.ReflectionUtils.createNoArgConstructorInstance(ReflectionUtils.java:186) at org.eclipse.yasson.internal.serializer.ObjectDeserializer.getInstance(ObjectDeserializer.java:92) at org.eclipse.yasson.internal.serializer.AbstractContainerDeserializer.deserialize(AbstractContainerDeserializer.java:62) at org.eclipse.yasson.internal.Unmarshaller.deserializeItem(Unmarshaller.java:57) at org.eclipse.yasson.internal.Unmarshaller.deserialize(Unmarshaller.java:50) at org.eclipse.yasson.internal.JsonBinding.deserialize(JsonBinding.java:45) at org.eclipse.yasson.internal.JsonBinding.fromJson(JsonBinding.java:52) at com.jsonbdemos.App.main(App.java:15) Caused by: java.lang.IllegalAccessException: class org.eclipse.yasson.internal.ReflectionUtils cannot access a member of class com.jsonbdemos.Widget with modifiers "public" at java.base/jdk.internal.reflect.Reflection.newIllegalAccessException(Reflection.java:361) at java.base/java.lang.reflect.AccessibleObject.checkAccess(AccessibleObject.java:589) at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:479) at org.eclipse.yasson.internal.ReflectionUtils.lambda$createNoArgConstructorInstance$1(ReflectionUtils.java:189) ... 9 more

我在规范 (JSR 367:"JSON-B: Java™ API for JSON Binding")(在 3.7 Java 类 部分)中没有看到任何需要公共(public)类进行反序列化的内容。

关于如何使用 JSON-B 反序列化为不公开的类实例有什么建议吗？

更新 (5/2/18):

JSR 367 声明“传递给反序列化操作的任何实例都必须具有公共(public)或 protected 无参数构造函数”，但如果构造函数是 protected 而不是 public。

我已报告该问题:Deserialization still not working with a protected no-arg constructor #118

Answer 1

我测试了一些变体，结果如下:

独立类(自己的源文件):

• class=public, ctor=public = 成功
• class=public, ctor=protected = 成功
• class=public, ctor=pkg-protected = 非法访问
• class=pkg-protected, ctor=public = 非法访问

静态内部类:

• class=public, ctor=public = 成功
• class=protected, ctor=public = 成功
• class=pkg-protected, ctor=public = 非法访问
• class=public, ctor=protected = 成功
• class=public, ctor=pkg-protected = 非法访问

非静态内部类:

• class=public, ctor=public = 非法访问

由此得出的要点是:

1. 公共(public)和 protected 作品，但包保护或更少的包不起作用(类和 ctor 必须具有等于或高于 protected 可见性)。
2. 静态内部类与独立类具有相同的行为
3. 非静态内部类不可访问，因为它们需要外部类的实例来实例化