59 |
{ |
{ |
60 |
/** |
/** |
61 |
* True if this object is marked accessible, which means the reflected |
* True if this object is marked accessible, which means the reflected |
62 |
* object bypasses normal security checks. <em>NOTE</em>Don't try messing |
* object bypasses normal security checks. |
|
* with this by reflection. You'll mess yourself up. |
|
63 |
*/ |
*/ |
64 |
// default visibility for use by inherited classes |
// default visibility for use by inherited classes |
65 |
boolean flag = false; |
boolean flag = false; |
87 |
* security check. If a security manager exists, it is checked for |
* security check. If a security manager exists, it is checked for |
88 |
* <code>ReflectPermission("suppressAccessChecks")</code>.<p> |
* <code>ReflectPermission("suppressAccessChecks")</code>.<p> |
89 |
* |
* |
90 |
* If <code>flag</code> is true, and the initial security check succeeds, |
* It is forbidden to set the accessibility flag to true on any constructor |
91 |
* this can still fail if a forbidden object is encountered, leaving the |
* for java.lang.Class. This will result in a SecurityException. If the |
92 |
* array half-modified. At the moment, the forbidden members are:<br> |
* SecurityException is thrown for any of the passed AccessibleObjects, |
93 |
* <ul> |
* the accessibility flag will be set on AccessibleObjects in the array prior |
94 |
* <li>Any Constructor for java.lang.Class</li> |
* to the one which resulted in the exception. |
|
* <li>Any AccessibleObject for java.lang.reflect.AccessibleObject |
|
|
* (this is not specified by Sun, but it closes a big security hole |
|
|
* where you can use reflection to bypass the security checks that |
|
|
* reflection is supposed to provide)</li> |
|
|
* </ul> |
|
|
* (Sun has not specified others, but good candidates might include |
|
|
* ClassLoader, String, and such. However, the more checks we do, the |
|
|
* slower this method gets). |
|
95 |
* |
* |
96 |
* @param array the array of accessible objects |
* @param array the array of accessible objects |
97 |
* @param flag the desired state of accessibility, true to bypass security |
* @param flag the desired state of accessibility, true to bypass security |
112 |
* manager exists, it is checked for |
* manager exists, it is checked for |
113 |
* <code>ReflectPermission("suppressAccessChecks")</code>.<p> |
* <code>ReflectPermission("suppressAccessChecks")</code>.<p> |
114 |
* |
* |
115 |
* If <code>flag</code> is true, and the initial security check succeeds, |
* It is forbidden to set the accessibility flag to true on any constructor for |
116 |
* this will still fail for a forbidden object. At the moment, the |
* java.lang.Class. This will result in a SecurityException. |
|
* forbidden members are:<br> |
|
|
* <ul> |
|
|
* <li>Any Constructor for java.lang.Class</li> |
|
|
* <li>Any AccessibleObject for java.lang.reflect.AccessibleObject |
|
|
* (this is not specified by Sun, but it closes a big security hole |
|
|
* where you can use reflection to bypass the security checks that |
|
|
* reflection is supposed to provide)</li> |
|
|
* </ul> |
|
|
* (Sun has not specified others, but good candidates might include |
|
|
* ClassLoader, String, and such. However, the more checks we do, the |
|
|
* slower this method gets). |
|
117 |
* |
* |
118 |
* @param flag the desired state of accessibility, true to bypass security |
* @param flag the desired state of accessibility, true to bypass security |
119 |
* @throws NullPointerException if array is null |
* @throws NullPointerException if array is null |
145 |
* after calling checkPermission. |
* after calling checkPermission. |
146 |
* |
* |
147 |
* @param flag the desired status |
* @param flag the desired status |
148 |
* @throws SecurityException if flag is true and this is one of the |
* @throws SecurityException if flag is true and this is a constructor |
149 |
* forbidden members mentioned in {@link setAccessible(boolean)}. |
* for <code>java.lang.Class</code>. |
150 |
*/ |
*/ |
151 |
private final void secureSetAccessible(boolean flag) |
private final void secureSetAccessible(boolean flag) |
152 |
{ |
{ |
153 |
if (flag && |
if (flag && |
154 |
((this instanceof Constructor |
(this instanceof Constructor |
155 |
&& ((Constructor) this).getDeclaringClass() == Class.class) |
&& ((Constructor) this).getDeclaringClass() == Class.class)) |
|
|| ((Member) this).getDeclaringClass() == AccessibleObject.class)) |
|
156 |
throw new SecurityException("Cannot make object accessible: " + this); |
throw new SecurityException("Cannot make object accessible: " + this); |
157 |
this.flag = flag; |
this.flag = flag; |
158 |
} |
} |