8

The Java Security Manager method checkMemberAccess() had a parameter that contained the class that Reflection was being called on. This method was deprecated, with a description saying to use checkPermission() instead. There are no parameters in checkPermission() that are similar to those in checkMemberAccess().

In a Security Manager, how do I get the Reflection target class without the checkMemberAccess() method?

i.e. if Class A performs reflection on Class B, I want to know that the target was Class B.

Strikegently
  • 2,251
  • 20
  • 23

1 Answers1

2

When you install the default security manager - application then uses the default security policy. In case you want to provide our own policy, you can do it in a policy file written as:

grant {
   permission java.lang.RuntimePermission "accessDeclaredMembers.{class name}";
   permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
};

CheckMemberAccess have default policy - to allow access to PUBLIC members, as well as access to classes that have the same class loader as the caller. In all other cases, this method calls checkPermission() with the RuntimePermission("accessDeclaredMembers") permission

For reflective operations use a ReflectPermission class and suppressAccessChecks which allows suppressing the standard java access checks - for public, default (package) access, protected, and private members - performed by reflected objects at their point of use.

But this is dangerous in that information (possibly confidential) and methods normally unavailable would be accessible to malicious code.

Once you have provided the policy file - you can check it as follows:

 try {
   ReflectPermission permission = new ReflectPermission("suppressAccessChecks");
   permission.checkGuard(null);
   System.out.println("Permission granted");
 } catch (SecurityException e) {
   System.out.println("Permission denied");
 }
Tamara Koliada
  • 1,200
  • 2
  • 14
  • 31
  • I want to allow reflection to all classes, but block reflection to a specific set of classes. Can I do this or do I need thousands of entries in that `grant` block? – Strikegently Jan 02 '19 at 11:43
  • 1
    There are few other ways to block reflection operations: 1)`setAccessible()` 2) `RetentionPolicy` annotated class gets a RuntimeInvisible\ RuntimeVisible class attribute or won't appear in the decompiled class 3) Use `module` concept in Java 9 and Reflection Permissions – Tamara Koliada Jan 02 '19 at 14:15