## Why is this an issue?

Developers may want to add some logic to handle deserialized objects before they are returned to the caller. This can be achieved by implementing the `readResolve` method.

Non-final classes implementing `readResolve` should not set its visibility to `private` as this would make it unavailable to child classes. Instead, mark `readResolve` as `protected`, allowing it to be inherited.

### Code examples

#### Noncompliant code example

    public class Fruit implements Serializable {
      private static final long serialVersionUID = 1;

      private Object readResolve() throws ObjectStreamException // Noncompliant, `readResolve` should not be private
      {...}

      //...
    }

    public class Raspberry extends Fruit implements Serializable { // This class has no access to the parent's "readResolve" method
      //...
    }

#### Compliant solution

    public class Fruit implements Serializable {
      private static final long serialVersionUID = 1;

      protected Object readResolve() throws ObjectStreamException // Compliant, `readResolve` is protected
      {...}

      //...
    }

    public class Raspberry extends Fruit implements Serializable { // This class has access to the parent's "readResolve"
      //...
    }

## Resources

- Java Object Serialization Specification - Object Input Classes