单例模式与反射的攻防之【道高一尺，魔高一丈】

文章目录

饿汉模式
- 没有保护的饿汉模式（可以被反射破坏）
- 反射破坏普通饿汉模式
- 带有保护的饿汉模式（构造函数加锁防反射）
- 反射尝试破坏带有保护的饿汉模式
懒汉模式
- 基本的懒汉模式（线程不安全）
- 基本的懒汉模式（线程安全）
- - synchronized
  - ReentrantLock
- 双检锁（DCL）懒汉模式
- 反射破坏带有保护的懒汉模式（构造函数加锁）
- 反射破坏带有保护的懒汉模式（构造函数加锁 + 信号灯保护机制）
- 反射破坏带有保护的懒汉模式（构造函数加锁 + 计数器保护机制）
静态内部类
- 静态内部类单例
- 反射破坏静态内部类单例：
枚举
- 枚举实现单例模式
- 反射尝试破坏枚举反射

单例模式

意图： 保证一个类仅有一个实例，并提供一个访问它的全局访问点

主要解决： 一个全局使用的类频繁地创建与销毁

何时使用： 当您想控制实例数目，节省系统资源的时候

如何解决： 判断系统是否已经有这个单例，如果有则返回，如果没有则创建

关键代码： 构造函数是私有的

注意：

1、单例类只能有一个实例
2、单例类必须自己创建自己的唯一实例
3、单例类必须给所有其他对象提供这一实例

优点：

1、在内存里只有一个实例，减少了内存的开销，尤其是频繁的创建和销毁实例（例如 Spring Bean）
2、避免对资源的多重占用（例如写文件操作）

缺点： 没有接口，不能继承，与单一职责原则冲突，一个类应该只关心内部逻辑，而不关心外面怎么样来实例化

注意事项： getInstance() 方法中需要使用同步锁 synchronized / Lock 防止多线程同时进入造成 instance 被多次实例化

饿汉模式

没有保护的饿汉模式（可以被反射破坏）

public class Hungry {private Hungry() {}private static final Hungry INSTANCE = new Hungry();public static Hungry getInstance() {return INSTANCE;}
}

测试：

public class SingleTest {static private final ThreadPoolExecutor POOL = new ThreadPoolExecutor(3,50,1,TimeUnit.SECONDS,new LinkedBlockingQueue<>(3),Executors.defaultThreadFactory(),new ThreadPoolExecutor.DiscardOldestPolicy());public static void main(String[] args) throws InterruptedException {for (int i = 0; i < 50; i++) {POOL.execute(() -> System.out.println(Hungry.getInstance()));}POOL.shutdown();TimeUnit.MILLISECONDS.sleep(10);}
}

这种单例模式基于classloader机制在类被装载时就被初始化了，因此不会存在多个线程调用时再产生多个实例的现象。但是就是因为类加载时就被初始化了，因此可能会导致内存的浪费

反射破坏普通饿汉模式

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException {Constructor<Hungry> declaredConstructor = Hungry.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);Hungry hungry1 = declaredConstructor.newInstance();Hungry hungry2 = declaredConstructor.newInstance();System.out.println(hungry1);System.out.println(hungry2);}
}

带有保护的饿汉模式（构造函数加锁防反射）

public class HungryWithProtect {private HungryWithProtect() {synchronized (HungryWithProtect.class){if(INSTANCE!=null){throw new RuntimeException("该单例已有一个实例！");}}}private static final HungryWithProtect INSTANCE = new HungryWithProtect();public static HungryWithProtect getInstance() {return INSTANCE;}
}

反射尝试破坏带有保护的饿汉模式

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException {Constructor<HungryWithProtect> declaredConstructor = HungryWithProtect.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);HungryWithProtect hungry1 = declaredConstructor.newInstance();HungryWithProtect hungry2 = declaredConstructor.newInstance();System.out.println(hungry1);System.out.println(hungry2);}
}

懒汉模式

基本的懒汉模式（线程不安全）

public class BaseLazy {private BaseLazy() {}private static BaseLazy instance = null;public static BaseLazy getInstance() {if (instance == null) {instance = new BaseLazy();}return instance;}
}

测试：

public class SingleTest {static private final ThreadPoolExecutor POOL = new ThreadPoolExecutor(3,50,1,TimeUnit.SECONDS,new LinkedBlockingQueue<>(3),Executors.defaultThreadFactory(),new ThreadPoolExecutor.DiscardOldestPolicy());public static void main(String[] args) throws InterruptedException {for (int i = 0; i < 50; i++) {POOL.execute(() -> System.out.println(BaseLazy.getInstance()));}POOL.shutdown();TimeUnit.MILLISECONDS.sleep(10);}
}

可以看到，在这种单例模式下，面对多个线程的操作，有可能会创建出多个实例

基本的懒汉模式（线程安全）

synchronized

public class BaseLazyWithSync {private BaseLazyWithSync() {}private static BaseLazyWithSync instance = null;public synchronized static BaseLazyWithSync getInstance() {if (instance == null) {instance = new BaseLazyWithSync();}return instance;}
}

测试：

public class SingleTest {static private final ThreadPoolExecutor POOL = new ThreadPoolExecutor(3,50,1,TimeUnit.SECONDS,new LinkedBlockingQueue<>(3),Executors.defaultThreadFactory(),new ThreadPoolExecutor.DiscardOldestPolicy());public static void main(String[] args) throws InterruptedException {for (int i = 0; i < 50; i++) {POOL.execute(() -> System.out.println(BaseLazyWithSync.getInstance()));}POOL.shutdown();TimeUnit.MILLISECONDS.sleep(10);}
}

在getInstance()方法上加了synchronized关键字，以此保证线程安全

但是synchronized太重了，在极端情况下对效率的影响还是很严重的

ReentrantLock

public class BaseLazyWithLock {private static final Lock LOCK = new ReentrantLock();private BaseLazyWithLock() {}private static BaseLazyWithLock instance = null;public static BaseLazyWithLock getInstance() {LOCK.lock();try {if (instance == null) {instance = new BaseLazyWithLock();}} catch (Exception e) {e.printStackTrace();} finally {LOCK.unlock();}return instance;}
}

测试：

public class SingleTest {static private final ThreadPoolExecutor POOL = new ThreadPoolExecutor(3,50,1,TimeUnit.SECONDS,new LinkedBlockingQueue<>(3),Executors.defaultThreadFactory(),new ThreadPoolExecutor.DiscardOldestPolicy());public static void main(String[] args) throws InterruptedException {for (int i = 0; i < 50; i++) {POOL.execute(() -> System.out.println(BaseLazyWithLock.getInstance()));}POOL.shutdown();TimeUnit.MILLISECONDS.sleep(10);}
}

ReentrantLock同样可以保证线程安全，但是会比synchronized关键字高效

双检锁（DCL）懒汉模式

public class DCLLazy {private DCLLazy() {}private volatile static DCLLazy instance = null;public static DCLLazy getInstance() {if (instance == null) {synchronized (DCLLazy.class) {if (instance == null) {instance = new DCLLazy();}}}return instance;}
}

测试：

public class SingleTest {static private final ThreadPoolExecutor POOL = new ThreadPoolExecutor(3,50,1,TimeUnit.SECONDS,new LinkedBlockingQueue<>(3),Executors.defaultThreadFactory(),new ThreadPoolExecutor.DiscardOldestPolicy());public static void main(String[] args) throws InterruptedException {for (int i = 0; i < 50; i++) {POOL.execute(() -> System.out.println(DCLLazy.getInstance()));}POOL.shutdown();TimeUnit.MILLISECONDS.sleep(10);}
}

DCL对变量instance加上了volatile关键字，并且在getInstance()方法中判空时进行了二次检测且在第二次检测时利用了synchronized关键字锁住了Class类模板来保证线程安全

反射破坏带有保护的懒汉模式（构造函数加锁）

public class LazyWithBaseProtect {private LazyWithBaseProtect() {synchronized (LazyWithBaseProtect.class) {if (INSTANCE != null) {throw new RuntimeException("该单例已有一个实例！");}}}private static LazyWithBaseProtect INSTANCE = null;public static LazyWithBaseProtect getInstance() {if (INSTANCE == null) {INSTANCE = new LazyWithBaseProtect();}return INSTANCE;}
}

测试：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException {LazyWithBaseProtect instance = LazyWithBaseProtect.getInstance();System.out.println(instance);Constructor<LazyWithBaseProtect> declaredConstructor = LazyWithBaseProtect.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);LazyWithBaseProtect instance1 = declaredConstructor.newInstance();System.out.println(instance1);}
}

这种方法在已有一个实例的情况下再通过反射创建实例时会失败报错，在一定程度上可以防止反射的破坏；但是如果两个实例都是通过反射创建的话，这种方法就失效了：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException {Constructor<LazyWithBaseProtect> declaredConstructor = LazyWithBaseProtect.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);LazyWithBaseProtect instance1 = declaredConstructor.newInstance();System.out.println(instance1);LazyWithBaseProtect instance2 = declaredConstructor.newInstance();System.out.println(instance2);}
}

反射破坏带有保护的懒汉模式（构造函数加锁 + 信号灯保护机制）

public class LazyWithLight {private static boolean philpyOwnLight = false;private LazyWithLight() {synchronized (LazyWithLight.class) {if (!philpyOwnLight) {philpyOwnLight = true;} else {throw new RuntimeException("该单例已有一个实例！");}}}private static LazyWithLight INSTANCE = null;public static LazyWithLight getInstance() {if (INSTANCE == null) {INSTANCE = new LazyWithLight();}return INSTANCE;}
}

测试：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException {Constructor<LazyWithLight> declaredConstructor = LazyWithLight.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);LazyWithLight instance1 = declaredConstructor.newInstance();System.out.println(instance1);LazyWithLight instance2 = declaredConstructor.newInstance();System.out.println(instance2);}
}

看上去好像可以防止单例模式被破坏了，但是真的是这样吗

信号灯法的核心是信号灯，即上面的philpyOwnLight，这个变量是对外隐藏的；但是一旦这个变量被获得到，那么这个信号灯就又成为了摆设：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException {Constructor<LazyWithLight> declaredConstructor = LazyWithLight.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);Field[] declaredFields = LazyWithLight.class.getDeclaredFields();for (Field field : declaredFields) {System.out.println(field.getName() + "  " + field.getType());}}
}

通过分析getDeclaredFields()获得的值，我就可以获得信号灯的变量名（philpyOwnLight）和类型（boolean），即便信号灯设置的再复杂再隐蔽，通过反射也是可以分析出来的。知道了信号灯以后我们就又可以去破坏单例了：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException, NoSuchFieldException {Field declaredField = LazyWithLight.class.getDeclaredField("philpyOwnLight");declaredField.setAccessible(true);Constructor<LazyWithLight> declaredConstructor = LazyWithLight.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);LazyWithLight instance1 = declaredConstructor.newInstance();declaredField.set(instance1, false);LazyWithLight instance2 = declaredConstructor.newInstance();declaredField.set(instance2, false);System.out.println(instance1);System.out.println(instance2);}
}

反射破坏带有保护的懒汉模式（构造函数加锁 + 计数器保护机制）

public class LazyWithCounter {private static int philpyCounter = 0;private LazyWithCounter() {synchronized (LazyWithCounter.class) {if (philpyCounter > 0) {throw new RuntimeException("该单例已有一个实例！");}philpyCounter++;}}private static LazyWithCounter INSTANCE = null;public static LazyWithCounter getInstance() {if (INSTANCE == null) {INSTANCE = new LazyWithCounter();}return INSTANCE;}
}

**计数器和信号灯保护机制原理都是一样的，都是通过一个标志位来标记该单例类是否已经有了一个实例对象，因此通过反射的破解方法也是大同小异
**
普通反射测试失败：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException, NoSuchFieldException {Constructor<LazyWithCounter> declaredConstructor = LazyWithCounter.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);LazyWithCounter instance1 = declaredConstructor.newInstance();LazyWithCounter instance2 = declaredConstructor.newInstance();System.out.println(instance1);System.out.println(instance2);}
}

反射获取计数器对象：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException, NoSuchFieldException {Field[] declaredFields = LazyWithCounter.class.getDeclaredFields();for (Field field : declaredFields) {System.out.println(field.getName() + "  " + field.getType());}}
}

反射破坏单例：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException, NoSuchFieldException {Field declaredField = LazyWithCounter.class.getDeclaredField("philpyCounter");declaredField.setAccessible(true);Constructor<LazyWithCounter> declaredConstructor = LazyWithCounter.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);LazyWithCounter instance1 = declaredConstructor.newInstance();declaredField.set(instance1, 0);LazyWithCounter instance2 = declaredConstructor.newInstance();declaredField.set(instance2, 0);System.out.println(instance1);System.out.println(instance2);}
}

静态内部类

静态内部类单例

public class SIC {private SIC() {}private static class InnerClass {private static final SIC SIC = new SIC();}public static SIC getInstance() {return InnerClass.SIC;}
}

测试：

public class SingleTest {static private final ThreadPoolExecutor POOL = new ThreadPoolExecutor(3,50,1,TimeUnit.SECONDS,new LinkedBlockingQueue<>(3),Executors.defaultThreadFactory(),new ThreadPoolExecutor.DiscardOldestPolicy());public static void main(String[] args) throws InterruptedException {for (int i = 0; i < 50; i++) {POOL.execute(() -> System.out.println(SIC.getInstance()));}POOL.shutdown();TimeUnit.MILLISECONDS.sleep(10);}
}

这种方式同样利用了classloader机制来保证初始化instance时只有一个线程，并且即便外部类被装载了，instance也不一定会被初始化，因为内部类没有被主动使用；只有当显式地调用getInstance()方法时才会显示装载内部类，从而实例化instance

反射破坏静态内部类单例：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException, NoSuchFieldException {Constructor<SIC> declaredConstructor = SIC.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);SIC instance1 = declaredConstructor.newInstance();SIC instance2 = declaredConstructor.newInstance();System.out.println(instance1);System.out.println(instance2);}
}

同理，反射同样可以破坏构造函数加锁的静态内部类单例和信号灯保护的静态内部类单例（这里就不再演示了）

枚举

枚举实现单例模式

public enum Enum {INSTANCE;public static Enum getInstance() {return INSTANCE;}
}

测试：

public class SingleTest {static private final ThreadPoolExecutor POOL = new ThreadPoolExecutor(3,50,1,TimeUnit.SECONDS,new LinkedBlockingQueue<>(3),Executors.defaultThreadFactory(),new ThreadPoolExecutor.DiscardOldestPolicy());public static void main(String[] args) throws InterruptedException {for (int i = 0; i < 50; i++) {POOL.execute(() -> System.out.println(Enum.getInstance()));}POOL.shutdown();TimeUnit.MILLISECONDS.sleep(10);}
}

使用枚举可以绝对保证单例模式的线程安全（尤其是可以避免通过反射来破坏单例）

反射尝试破坏枚举反射

首先看源码就可以知道枚举类是不怕反射的了：

但是我还是想试试，至少让我看到这个报错吧…

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException, NoSuchFieldException {Constructor<Enum> declaredConstructor = Enum.class.getDeclaredConstructor(null);declaredConstructor.setAccessible(true);Enum instance1 = declaredConstructor.newInstance();Enum instance2 = declaredConstructor.newInstance();System.out.println(instance1);System.out.println(instance2);}
}

虽然出现了报错，但却并不是我们想要的源码中的那个报错，仔细看报错信息，是因为getDeclaredConstructor()方法获得构造函数时参数不对

查看idea生成的class文件：

发现这里的构造函数的确是无参的，看来时idea欺骗了我们…

那接下来用javap -c命令反编译试试：

发现构造函数有一个String类型的参数，好，再用反射试试：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException, NoSuchFieldException {Constructor<Enum> declaredConstructor = Enum.class.getDeclaredConstructor(String.class);declaredConstructor.setAccessible(true);Enum instance1 = declaredConstructor.newInstance();Enum instance2 = declaredConstructor.newInstance();System.out.println(instance1);System.out.println(instance2);}
}

还是不行，难道javap -c也欺骗了我们？好吧…祭出杀手锏——jad来看看：

可以看到，这里的构造函数其实是有两个参数的，分别是String和int；接下来再次用反射试试看：

public class RefSingleTest {public static void main(String[] args) throws InterruptedException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException, NoSuchFieldException {Constructor<Enum> declaredConstructor = Enum.class.getDeclaredConstructor(String.class, int.class);declaredConstructor.setAccessible(true);Enum instance1 = declaredConstructor.newInstance();Enum instance2 = declaredConstructor.newInstance();System.out.println(instance1);System.out.println(instance2);}
}

发现了我们想要的错误，也明确了基于枚举实现的单例模式是无法通过反射来进行破坏的