Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ObjectToObjectConverter should be able to use constructors on non-public classes [SPR-14304] #18876

Closed
spring-projects-issues opened this issue May 25, 2016 · 4 comments

Comments

@spring-projects-issues
Copy link
Collaborator

@spring-projects-issues spring-projects-issues commented May 25, 2016

Oliver Drotbohm opened SPR-14304 and commented

ObjectToObjectConverter makes factory methods accessible before invoking them, but doesn't do the same for constructor invocations.


Affects: 3.2.17, 4.2.6, 4.3 RC2

Referenced from: commits 9659bc5, 1e2b8ab, 17d6221, edf1df3

Backported to: 4.2.9, 3.2.18

@spring-projects-issues
Copy link
Collaborator Author

@spring-projects-issues spring-projects-issues commented Oct 30, 2016

Martin Macko commented

I was looking into this and found out that getValidatedMember cannot return a private method or constructor. So makeAccessible doesn't make sense there.
I've submitted a PR with a test that proves this and removes makeAccessible from convert().

#1227

@spring-projects-issues
Copy link
Collaborator Author

@spring-projects-issues spring-projects-issues commented Oct 30, 2016

Juergen Hoeller commented

While getValidatedMember will indeed only return a public method or constructor, such a member may be declared on a non-public (e.g. package visible) class provided by the application... which requires setAccessible(true) again. In that sense, the original request is valid here: We need to call makeAccessible for constructors as well, so we're doing this as of 4.3.4 / 4.2.9 now.

In any case, thanks for bringing this issue to my attention again! It seems to have got lost back then...

@spring-projects-issues
Copy link
Collaborator Author

@spring-projects-issues spring-projects-issues commented Oct 31, 2016

Martin Macko commented

I didn't know that, good to know :)
I've closed the pull request and will write tests for this at least, as there are none now, if that's ok?

@spring-projects-issues
Copy link
Collaborator Author

@spring-projects-issues spring-projects-issues commented Oct 31, 2016

Juergen Hoeller commented

DefaultConversionServiceTests had tests against private classes already but those weren't really effective since the test classes were colocated with the DefaultConversionService implementation class in the same package (so the default access rules in the JVM still considered it valid, even without an accessibility override). I moved those tests to a different package along with this fix last night, enforcing the need for setAccessible(true). In other words, with that test class in a different package, a few tests will fail if you comment out the makeAccessible calls now. So I guess we are covered there already. Thanks for volunteering, in any case!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants