For example, the use of reflection to access or modify fields is not allowed unless those fields are already accessible and modifiable by other means, such as through getter and setter methods. In particular, reflection must not be used to provide access to classes, methods, and fields unless those items are already accessible without the use of reflection. Exercise extreme caution when the use of reflection is necessary. Consequently, programmers should avoid using the reflection APIs when it is feasible to do so. Use of reflection complicates security analysis and can easily introduce security vulnerabilities. The remaining set*() and get*() field reflection methods perform only the language access checks and are vulnerable. Nevertheless, these methods should be used only with extreme caution. AtomicReferenceFieldUpdater.newUpdater()īecause the setAccessible() and getAccessible() methods of class are used to instruct the JVM to override the language access checks, they perform standard (and more restrictive) security manager checks and consequently lack the vulnerability discussed in this rule. The following table lists the APIs that should be used with care. Consequently, unwary programmers can create an opportunity for a privilege escalation attack by untrusted callers. However, a class with private members but also with a public method that uses reflection to indirectly access those members can inadvertently enable a foreign object to access those private members using the public method, bypassing the intended accessibility restrictions.

That is, a foreign object that cannot access private members of a class normally also cannot use reflection to access those members.

When a method uses reflection to access class members (that is, uses the APIs belonging to the package), the reflection uses the same restrictions. However, can be granted with action suppressAccessChecks to override this default behavior.įor example, the Java Virtual Machine (JVM) normally protects private members of a class from being accessed by an object of a different class. The default security manager throws a in these circumstances. When the default security manager is used, it prevents fields that are normally inaccessible from being accessed under reflection. t(someObject, returnValue(newValue, field.getType()))

Java reflection nested field