I need to prevent the use of reflection to get a private Properties field from a superclass. How can I use the Java security manager to do this

Question

I have an unusual super class.

it instantiates the subclass using reflection, and calls a subclass method in the main method

ie, String processor= System.getProperty(PROCESSOR_CLASS); sub = (ClassName) class.forName(processor).newInstance();

sub.init(props);

I am writing a wrapper (sub) for the super class that will also be abstract, and will be used as a base class by a large number of subclasses.

The problem I have is that props contains sensitive information. I need to prevent a subclass that extends from sub from using reflection to access the props.
Can anyone give me an example of doing this using the Java security manager, or some other method? Thanks very much for your help

If your `init` method in the abstract wrapper isn't final then it doesn't matter wether or not the property is 'protected' from reflection or not. — Perception, Jun 07 '13 at 11:29

score 1 · Answer 1 · answered Jun 07 '13 at 11:25

1

By default the JVM does not have a SecurityManager available. A security manager could be installed either by passing the following option to the jvm

-Djava.security.manager

or by setting one in the code

System.setSecurityManager(new SecurityManager());

answered Jun 07 '13 at 11:25

fGo

1,146
5
11

the you could avoid things like this `Field field = myObject.getClass().getField("myPrivateField"); field.setAccessible(true);` – fGo Jun 07 '13 at 11:28

I need to prevent the use of reflection to get a private Properties field from a superclass. How can I use the Java security manager to do this

1 Answers1