Non-Serializable Field in Serializable Class
ID |
java.nonserializable_field |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
reliability |
Description
Reports non-transient fields in a Serializable class whose type is known to be non-serializable. Serializing an object that contains a non-serializable field throws NotSerializableException at runtime.
Rationale
Common non-serializable types such as Thread, Connection, Socket, and InputStream cannot be serialized. Having them as non-transient fields in a Serializable class will cause runtime failures during serialization.
public class Worker implements Serializable {
private Thread workerThread; // Bug: Thread is not serializable
}Remediation
Mark the field as transient or use a serializable alternative.
public class Worker implements Serializable {
private transient Thread workerThread;
}