字节码操作有哪些危险（如果有）？
字节码增强似乎是一项非常有趣的 Java 技术，但它给人一种有点“黑魔法”的感觉。使用它是否有任何缺点（除了将功能添加到从源代码中不明显的类中这一事实之外）？
它会导致安全、序列化等问题吗？
Bytecode enhancement seems like a very interesting Java technique, but it has the feel of a bit of "black magic" about it. Are there any disadvantages to using it (other than the fact that functionality is added to classes that is not apparent from the source code)?
Does it cause problems with security, serialization, etc.?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
一件事是由字节码操作产生的错误可能更难以诊断。源代码的检查和源代码级调试将更加困难。
验证者（理论上）应该防止修改后的字节码破坏核心类型系统并破坏 JVM。 （不言而喻，不应该允许不受信任的代码进行字节码修改，因此我们可以忽略这种情况。）但是，在过去，一些 Java 字节码验证器并不彻底。
此外，字节码修改：
字节码修改可能会导致现有的序列化对象无法被修改后的类读取；例如，通过添加和删除字段，或者通过更改类的超类和接口。但是，您可以通过更改源代码来完成相同的操作。
One thing is that bugs created by bytecode manipulation are likely to be more difficult to diagnose. Examination of the source code, and source level debugging will be harder.
The verifier should (in theory) prevent the modified bytecode from breaking the core type system and corrupting the JVM. (And it goes without saying that untrusted code shouldn't be allowed to do bytecode modification, so we can discount that scenario.) However, in the past, some Java byte code verifiers have been less than thorough.
Furthermore, bytecode modification :
Bytecode modification can do things that will make existing serialized objects unreadable by the modified class; e.g. by adding and removing fields, or by changing a classes superclass and interfaces. However, you can do the same thing by changing the sourcecode.
JVM 验证字节码，但是异常字节码 可能代表安全威胁。
The JVM verifies bytecodes, but deviant bytecode may represent a security threat.