Reflection Security

Question

How to enforce reflection security by not allow the Method, Field, Constructor object to call setAccessible(true) ? SecurityPolicy File or something else?

Normally for stand-alone Java applications there is no SecurityManager registered.

I using this System.setSecurityManager(new SecurityManager());

This approach will work for calling methods.

I would like to enforce the whole jar or client code that uses the jar is not allow to call setAccessible(true);

Any better approach ?

Thanks.

eis · Accepted Answer · 2013-02-01T15:38:05.717

Um, it does work for setAccessible. See:

class A {
  private String method1() {
    return "Hello World!";
  }
}

and

import java.lang.reflect.Method;

class B {
  public static void main(String[] args) throws Exception {
    System.setSecurityManager(new SecurityManager());
    Class clazz = A.class;
    Method m = clazz.getDeclaredMethod("method1");
    m.setAccessible(true);
  }
}

Results in

Exception in thread "main" java.security.AccessControlException: access denied ("java.lang.reflect.ReflectPermission" "suppressAccessChecks")
        at java.security.AccessControlContext.checkPermission(Unknown Source)
        at java.security.AccessController.checkPermission(Unknown Source)
        at java.lang.SecurityManager.checkPermission(Unknown Source)
        at java.lang.reflect.AccessibleObject.setAccessible(Unknown Source)
        at B.main(B.java:8)

One reason it might've not worked for you is that according to comments in this post it didn't use to work in Java 1.5, but works in 6 and thereafter.

Edit: to deny it for specific jars, you need to either use a policy file, example:

// specific file
grant codeBase "file:/test/path/tools.jar" {
  // no permissions for this one
};

// default to giving all
grant {
  permission java.security.AllPermission;
};

There's two ways of specifying the policy file, either give it as additions to default, or give only those that are specified (source):

If you use
java -Djava.security.manager -Djava.security.policy==someURL SomeApp
(note the double equals) then just the specified policy file will be used; all the ones indicated in the security properties file will be ignored.

...or implement a custom security manager, which doesn't look that hard. Haven't done that myself though.

There seems to be [another thread](http://stackoverflow.com/questions/2315066/is-there-a-way-for-a-securitymanager-in-java-to-selectively-grant-reflectpermiss?rq=1) about the same subject, too. — eis, Feb 01 '13 at 15:44
I want to enforce no calling to setAccessible method in my apps. — nicholas, Feb 05 '13 at 06:24
@peterwkc yes, and I've answered that you can do that with SecurityManager? — eis, Feb 05 '13 at 07:06
How to do that with SecurityManager ? u mean custom security manager ? — nicholas, Feb 07 '13 at 08:35
@peterwkc no, using standard one, like in my example. but you'd need to use either a policy file or a custom security manager to deny it only for specific jar(s). — eis, Feb 07 '13 at 08:40

Reflection Security

1 Answers1

Linked