Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ObjectToObjectConverter should be able to use constructors on non-public classes [SPR-14304] #18876

Closed
spring-projects-issues opened this issue May 25, 2016 · 4 comments
Assignees
Labels
in: core Issues in core modules (aop, beans, core, context, expression) status: backported An issue that has been backported to maintenance branches type: bug A general bug
Milestone

Comments

@spring-projects-issues
Copy link
Collaborator

Oliver Drotbohm opened SPR-14304 and commented

ObjectToObjectConverter makes factory methods accessible before invoking them, but doesn't do the same for constructor invocations.


Affects: 3.2.17, 4.2.6, 4.3 RC2

Referenced from: commits 9659bc5, 1e2b8ab, 17d6221, edf1df3

Backported to: 4.2.9, 3.2.18

@spring-projects-issues
Copy link
Collaborator Author

Martin Macko commented

I was looking into this and found out that getValidatedMember cannot return a private method or constructor. So makeAccessible doesn't make sense there.
I've submitted a PR with a test that proves this and removes makeAccessible from convert().

#1227

@spring-projects-issues
Copy link
Collaborator Author

Juergen Hoeller commented

While getValidatedMember will indeed only return a public method or constructor, such a member may be declared on a non-public (e.g. package visible) class provided by the application... which requires setAccessible(true) again. In that sense, the original request is valid here: We need to call makeAccessible for constructors as well, so we're doing this as of 4.3.4 / 4.2.9 now.

In any case, thanks for bringing this issue to my attention again! It seems to have got lost back then...

@spring-projects-issues
Copy link
Collaborator Author

Martin Macko commented

I didn't know that, good to know :)
I've closed the pull request and will write tests for this at least, as there are none now, if that's ok?

@spring-projects-issues
Copy link
Collaborator Author

Juergen Hoeller commented

DefaultConversionServiceTests had tests against private classes already but those weren't really effective since the test classes were colocated with the DefaultConversionService implementation class in the same package (so the default access rules in the JVM still considered it valid, even without an accessibility override). I moved those tests to a different package along with this fix last night, enforcing the need for setAccessible(true). In other words, with that test class in a different package, a few tests will fail if you comment out the makeAccessible calls now. So I guess we are covered there already. Thanks for volunteering, in any case!

@spring-projects-issues spring-projects-issues added type: bug A general bug status: backported An issue that has been backported to maintenance branches in: core Issues in core modules (aop, beans, core, context, expression) labels Jan 11, 2019
@spring-projects-issues spring-projects-issues added this to the 4.3.4 milestone Jan 11, 2019
This was referenced Jan 11, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: core Issues in core modules (aop, beans, core, context, expression) status: backported An issue that has been backported to maintenance branches type: bug A general bug
Projects
None yet
Development

No branches or pull requests

2 participants