You certainly can. By specifying this permission in your policy file as
such:
grant {
permission java.reflect.ReflectPermission suppressAccessChecks";
};
and then doing the following in some code:
...
Class clazz = Class.forName("Foo");
Field f = clazz.getField("id");
Foo foo = (Foo)clazz.newInstance();
f.set(foo, "Changed");
...
The field "id" would have the new value. Works for methods too.
The reason, if you care, is because there are certain things the VM needs to
do that involve calling private members. Most notably, the private
readObject and writeObject methods that a class can provide have to be
accessible to the VM. Now, of course, ANYONE could access fields/methods if
granted access.
Obviously, this is not a good thing to allow anyone as the policy file above
does...
Hope this helps,
----------------------------------------------
Todd M Greanier
Chief Java Technologist
Lake Systems, Inc
[EMAIL PROTECTED]
"Act only on that maxim whereby thou canst at the same time will that it
should become a universal law." (Imannuel Kant)
--------------------------------------------
> I am afraid that I am not following this discussion. I would appreciate
> some clarifiaction, if you don't mind. It appears to me that Imre is
> claiming that the Java 2 Platform security model allows you to violate
> the encapsulation features that are specified in the Java Language
> Specification.
>
> Are you saying that you can take a class like this:
>
> public class Foo
> {
> private String id;
> public String somethingElse;
>
> public void setSomethingElse( String s )
> {
> somethingElse = s;
> }
>
> ...
> }
>
> and through some security policy setting be able to manipulate the "id"
> String? I'm either grossly misunderstanding your point or else you'll
> have to show me where this mechanism is described.
>
===========================================================================
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff EJB-INTEREST". For general help, send email to
[EMAIL PROTECTED] and include in the body of the message "help".
