Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DefaultConstructionProxyFactory can throw SecurityException #64

Closed
gissuebot opened this issue Jul 7, 2014 · 6 comments
Closed

DefaultConstructionProxyFactory can throw SecurityException #64

gissuebot opened this issue Jul 7, 2014 · 6 comments

Comments

@gissuebot
Copy link

From kevinb9n on March 14, 2007 11:48:22

I accidentally ended up trying to inject a Class object, whose constructor
can't be made accessible by 'setAccessible(true)' (currently line 40 of
this class).  We should catch this SecurityException and rethrow with one
of our trademark helpful error messages. :)

Original issue: http://code.google.com/p/google-guice/issues/detail?id=64

@gissuebot
Copy link
Author

From crazyboblee on March 14, 2007 17:53:48

Hmmmmm, why wouldn't setAccessible() work?

@gissuebot
Copy link
Author

From crazyboblee on March 14, 2007 19:34:33

Assuming you have permissions (Kevin does).

@gissuebot
Copy link
Author

From dhanji on March 14, 2007 21:14:38

other than a SecurityManager? nothing should... is there a specific message?
conceivably something viral like a class being loaded as a result of the call might?
Im really reaching tho...

@gissuebot
Copy link
Author

From kevinb9n on March 14, 2007 21:22:45

oops, said my last comment in email only.

Guice ended up trying to construct an instance of the class java.lang.Class.  It was
an accident, and no way is java gonna let you just setAccessible() on that thing, and
let's be glad for that. :)

Anyway, apart from the java.lang.Class example, we ought to make sure that guice
always reports problems helpfully, no matter what the security manager.

@gissuebot
Copy link
Author

From limpbizkit on June 04, 2008 23:17:02

(No comment was entered for this change.)

Labels: -Priority-Medium Priority-Low Milestone-Release2.0

@gissuebot
Copy link
Author

From limpbizkit on July 12, 2008 10:18:51

Only Class.class and Constructor.class disallow setAccessible. These cases were indirectly fixed when we
disallowed private no-arg constructors that weren't annotated with @Inject.

For the general SecurityManager case, this is probably not worth the effort. I tried to write a test that uses a
SecurityManager, but it seems that almost anything we do has the potential of throwing a SecurityException. For
example, looking up the annotations on a type indirectly requires the reflect permission.

Status: Fixed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant