首先你想讨论一个东西的话，自己先做一下调研，不要一下子就把问题扔给别人，这样子太不负责。要是你在 stack overflow 提问的话，你这个问题就是不符合社区规范的。你碰到了什么问题？你做了调研吗？你发现了什么？你不明白什么？你什么都没说，你叫别人怎么看你？你叫别人怎么帮你？

@whoami9894 产生对象的 class 是自己写的，setXX 能做什么不是完全由自己决定的吗？实例化 class 的一个对象后，会根据序列化之后的内容对属性设置不同的值。如果 setXX 方法除了赋值之外还做了“其他的事情”，不管是什么方式的反序列化，都会做“其他的事情”的呀😅，不会取决于“序列化的内容是否被修改”。是我哪里没有理解吗？😯

@sayuria 我还是有点不明白，就算替换了内容，那也是数据（对象的属性）改变了，代码执行的逻辑还是不变的。可以具体讲解一下“怎么造成安全漏洞”的吗？

？我有一点疑问，这个问题已经有答案了（见附言），为什么还有人收藏呢？

来自 Java Concurrency in Practice 。

Just as each Java object can act as a lock, each object can also act as a condition queue, and the wait, notify, and notifyAll methods in Object constitute the API for intrinsic condition queues. An object’s intrinsic lock and its intrinsic condition queue are related: in order to call any of the condition queue methods on object X, you must hold the lock on X. This is because the mechanism for waiting for state-based conditions is necessarily tightly bound to the mechanism for preserving state consistency: you cannot wait for a condition unless you can examine the state, and you cannot release another thread from a condition wait unless you can modify the state.

Object.wait atomically releases the lock and asks the OS to suspend the current thread, allowing other threads to acquire the lock and therefore modify the object state. Upon waking, it reacquires the lock before returning. Intuitively, calling wait means “I want to go to sleep, but wake me when something interesting happens”, and calling the notification methods means “something interesting happened”.

From [\[SERVER-30474\] leading $facet with each facet beginning with $match should add $match before $facet - MongoDB]( https://jira.mongodb.org/browse/SERVER-30474), *$facet is not smart enough to use an index. if the only stage in a pipeline is $facet, the planning system will simply default to a COLLSCAN.*

AOP != 动态代理