Java Reflection, change private static final field didn't do anything

Question

I'm trying to change a private static final field with Java Reflection. But it just fail. Did someone have an idea ?

Here's my code :

public class SecuredClass {
    private static final String securedField = "SecretData";
    public static String getSecretData() { return securedField; }
}

public class ChangeField {
    static void setFinalStatic(Field field, Object newValue) throws Exception
    {
        field.setAccessible(true);

        Field modifiersField = Field.class.getDeclaredField("modifiers");
        modifiersField.setAccessible(true);
        modifiersField.setInt(field, field.getModifiers() & ~ Modifier.FINAL);

        field.set(null, newValue);
    }

    public static void main(String args[]) throws Exception
    {
        System.out.println("Before = " + SecuredClass.getSecretData());

        Field stringField = SecuredClass.class.getDeclaredField("securedField");
        stringField.setAccessible(true);
        setFinalStatic(stringField, "Screwed Data!");


        System.out.println("After = " + Java_FileMerger_Main.getSecretData());
    }
}

And here's my output :

Before = SecretData
After = SecretData

I've tried to remove the SecurityManager with System.setSecurityManager(null); But it didn't change anything. I know this is evil, but i want to get it work. I hope someone could help me.

Your 'after' value comes from `Java_FileMerger_Main` not `SecuredClass` — DNA, Feb 22 '12 at 08:35
Java Reflection is not for changing the byte code of classes. This restriction is for security reasons too. `setInt(42)` for instance would be the same as `SecuredClass.securedField = 42;`. — Joop Eggen, Feb 22 '12 at 08:38

score 6 · Accepted Answer · edited May 23 '17 at 12:00

The semantics of changing final fields via reflection are not defined (cf. specification). It is not guaranteed that a reflective write to a final field will ever be seen when reading from the field.

Especially with static final fields which have a constant assigned (as in your case), the compiler will often inline the constant and thus the field won't be accessed at all during runtime (only when you use reflection).

The SecurityManager is not relevant here. If using reflection would be forbidden by a SecurityManager, the operation would throw an exception, and not fail silently.

The answers to the question Change private static final field using Java reflection provide some more detail, including an example where you can see in the byte code that constants get inlined.

score 1 · Answer 2 · edited Oct 04 '16 at 13:41

1

I also had problems with the given example above. For me it worked after I did not define the String as a literal but as an Object.

private static final String SECURED_FIELD = String.valueOf("SecretData");

Or

private static final String SECURED_FIELD = new String("SecretData");

Not the best solution if you want to benefit from literals but I did not have to care about it.

edited Oct 04 '16 at 13:41

guicey

686
5
14

answered Sep 12 '13 at 13:22

magicroomy

395
1
6
19

score 1 · Answer 3 · answered Dec 31 '13 at 13:44

There is a work around for this. if you set the value of the private static final filed in the static {} block it will work because it will not inline the field:

private static final String MY_FIELD;

static {
    MY_FIELD = "SomeText"
}

...

Field field = VisitorId.class.getDeclaredField("MY_FIELD");

field.setAccessible(true);
field.set(field, "fakeText");

Java Reflection, change private static final field didn't do anything

3 Answers3