apache /
bval /
bee61eadba5335021a5be6c49c0b922630941c31 [BVAL-176] Remove resetting of accessible flag when security manager is present
This feature will not work without some synchronization on the
reflection data itself in multithreaded environment.
Therefore the feature has been removed due to following concerns:
1. resetting accessible flag for security manager does not mean that for
short period of time the flag is not actually set and bad code could
exploit that - therefore resetting accesible back is not really making
private/protected members unaccessible to other code. This is a design flaw in
reflection , if accessible flag would be per thread it would work much better.
2. since accessible flag is global it would require synchronization to make it work correctly,
which is costly. Current implementation just breaks for SM present case
- it throws 'inaccessible' exceptions since it does not synchronize at
all.
3. there is no saying what would need to be synchronized (probably the
field or method reflected instances but it is not specified). Therefore
synchronizing it would work only within scope of a single framework
(bval).
4. other frameworks typically don't reset back accessible and just keep
the flag set. Therefore any synchronization mechanism specific to bval would not cooperate
nicely or at all with other frameworks (like spring for instance).
6 files changed
