Spring/spring-data-redis
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

DATAREDIS-764 - Fix code quotation and mention default serializers.

Browse Source 
Original Pull Request: #305
This commit is contained in:
Mark Paluch
2018-01-30 12:50:34 +01:00
committed by Christoph Strobl
parent 91529e9f16
commit 0b7ef04ba4
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/main/asciidoc/reference/redis.adoc
View File

@@ -299,20 +299,22 @@ The conversion between the user (custom) types and raw data (and vice-versa) is
This package contains two types of serializers which as the name implies, takes care of the serialization process:
* Two-way serializers based on`RedisSerializer`.
* Element readers and writers using `RedisElementReader` and `RedisElementWriter`.
* Two-way serializers based on ``RedisSerializer``.
* Element readers and writers using `RedisElementReader` and ``RedisElementWriter``.
The main difference between these variants is that `RedisSerializer` primarily serializes to `byte[]` while readers and writers use `ByteBuffer`.
Multiple implementations are available out of the box, two of which have been already mentioned before in this documentation:
* the `StringRedisSerializer`
* `JdkSerializationRedisSerializer`
* `JdkSerializationRedisSerializer` which is used by default for `RedisCache` and ``RedisTemplate``.
* the ``StringRedisSerializer``.
However one can use `OxmSerializer` for Object/XML mapping through Spring http://docs.spring.io/spring/docs/{springVersion}/spring-framework-reference/data-access.html#oxm[OXM] support or either `Jackson2JsonRedisSerializer` or `GenericJackson2JsonRedisSerializer` for storing data in http://en.wikipedia.org/wiki/JSON[JSON] format.
Do note that the storage format is not limited only to values - it can be used for keys, values or hashes without any restrictions.
WARNING: `RedisCache` and `RedisTemplate` are configured by default to use Java native serialization. Java native serialization is known for allowing remote code execution caused by payloads that exploit vulnerable libraries and classes injecting unverified bytecode. You might want to consider other serialization mechanisms such as JSON or XML to prevent flaws. Alternatively, use a customized `ObjectInputStream` whitelisting classes you trust to be deserialized properly. See also https://www.owasp.org/index.php/Deserialization_of_untrusted_data[OWASP: Deserialization of untrusted data].
[[redis.hashmappers.root]]
== Hash mapping