Alwaysgaurav1 opened a new pull request, #1793:
URL: https://github.com/apache/commons-lang/pull/1793
## Summary
Fixes `ConstructorUtils.getMatchingAccessibleConstructor` and
`ConstructorUtils.invokeConstructor` to properly enforce class accessibility
checks on non-public classes (e.g. package-private classes or public inner
classes declared inside non-public outer classes), achieving consistency across
exact matching, inexact matching, and `MethodUtils` (following PR #1783).
## Problem
In `ConstructorUtils.getMatchingAccessibleConstructor(Class<T> cls,
Class<?>... parameterTypes)`:
1. The exact-match fast-path attempted to resolve
`cls.getConstructor(parameterTypes)` directly.
2. In Java reflection, `Class.getConstructor(...)` returns any constructor
with the `public` modifier, even if declaring class `cls` is package-private or
enclosed in a non-public outer class.
3. The fast-path called `MemberUtils.setAccessibleWorkaround(...)` directly
and returned the constructor without verifying whether `cls` is accessible.
4. Conversely, the fallback loop for inexact assignment-compatible matching
filtered each candidate through `getAccessibleConstructor(ctor)`, which checks
`MemberUtils.isAccessible(ctor) && isAccessible(ctor.getDeclaringClass())`.
This created inconsistent behavior:
- `ConstructorUtils.getAccessibleConstructor(PackagePrivateBean.class,
exactTypes)` returned `null`.
-
`ConstructorUtils.getMatchingAccessibleConstructor(PackagePrivateBean.class,
inexactTypes)` returned `null`.
- But
`ConstructorUtils.getMatchingAccessibleConstructor(PackagePrivateBean.class,
exactTypes)` bypassed the check and returned the constructor.
- Consequently,
`ConstructorUtils.invokeConstructor(PackagePrivateBean.class, exactArgs)`
attempted reflective instantiation on non-public classes (violating access
control and throwing `IllegalAccessException` or `InaccessibleObjectException`
under JPMS), whereas inexact arguments threw `NoSuchMethodException("No such
accessible constructor on object: ...")`.
## Changes
1. **`ConstructorUtils.java`**:
- In `getMatchingAccessibleConstructor`:
- Added an early return `if (!isAccessible(cls)) return null;`. Since
constructors are never inherited and always belong to their declaring class, an
inaccessible class can never have an accessible constructor.
- In the exact-match `try` block, verified the candidate using
`getAccessibleConstructor(cls.getConstructor(parameterTypes))` before returning.
- In `getAccessibleConstructor(Class<T> cls, Class<?>... parameterTypes)`:
- Added early return `if (!isAccessible(cls)) return null;` for
consistent fast-path checking.
2. **`ConstructorUtilsTest.java`**:
- Added `testGetMatchingAccessibleConstructorOnNonPublicClass` asserting
that `getMatchingAccessibleConstructor` returns `null` for non-public classes
and public inner classes of non-public outer classes (for both exact and
inexact signatures).
- Added `testInvokeConstructorOnNonPublicClass` and
`testInvokeExactConstructorOnNonPublicClass` asserting that
`NoSuchMethodException` is consistently thrown.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
