Add a bundle 'jdk-reflection' #86
Conversation
…on calls which are usually blocked by SecurityManagers
|
Cool thanks! I will look into merging it. We also collected some bad stuff which might be added as bundles. |
|
I general, I would remove the Method#invoke stuff. The bad stuff is only setAccessible(). Reflection is not bad per se, but working around security is a problem. |
|
|
||
| java.lang.reflect.AccessibleObject#setAccessible(java.lang.reflect.AccessibleObject[], boolean) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9 | ||
| java.lang.reflect.AccessibleObject#setAccessible(boolean) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9 | ||
| java.lang.reflect.Method#invoke(java.lang.Object, java.lang.Object[]) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9 |
There was a problem hiding this comment.
As said on issue, I would remove this. It is not bad and won't fail with security managers, unless very restructive. But setAccessible() is a no-go.
…Accessible() checks
|
Sure, I have updated the pull request accordingly now. |
|
Thanks. Currently I am thinking about the fact, if the reflection bundle should be made dependent on Java version like unsafe or deprecated. One small thing. The test class should be named |
Add a bundle 'jdk-reflection'
|
I merged this. Will do some cleanups and adding docs in a minute. |
This allows to forbid certain reflection calls which are usually blocked by SecurityManagers, more might be useful, but this is the bare minimum set that often indicates invalid access.