JDK-4060948 : access to another package superclass protected constructor is permitted
  • Type: Bug
  • Component: hotspot
  • Sub-Component: runtime
  • Affected Version: 1.1.3
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: solaris_2.5
  • CPU: sparc
  • Submitted: 1997-06-24
  • Updated: 1997-07-23
  • Resolved: 1997-07-23
Related Reports
Duplicate :  
Description

Name: ngC57085			Date: 06/24/97



Java Virtual Machine permits to use protected constructors of the superclass
from another package by an invocation of the method newInstance of class Class.


JLS (6.6.2) says:

"
A protected member or constructor of an object may be accessed from outside 
the package in which it is declared only by code that is responsible for the 
implementation of that object. Let C be the class in which a protected member 
or constructor is declared and let S be the subclass of C in whose
declaration the use of the protected member or constructor occurs. Then: 
            .   .   .
   Otherwise, if an access is of a protected constructor: 
            .   .   .
      If the access is by an invocation of the method newInstance of 
      class Class, then the access is not permitted. 
"

Next test shows that the access to protected constructor by an invocation of the 
method newInstance of class Class is permitted when the class where this 
constructor is used and the class where it is declared are in the different 
packages.


> jac113 -d . name06801c.java
> jac113 -d . name06801.java
> ja113 -verify name06801.name06801
25
failed
>
------------------------name06801c--------------
package name06801.name06801a;

public class name06801c {
   protected name06801c (int a) { n = a; }
   protected name06801c () { n = n*n; }
   public int n = 5;
}
--------------------------------------
------------------------name06801--------------
package name06801;

import java.io.PrintStream;
import name06801.name06801a.name06801c;

public class name06801 { 
  public static void main(String argv[]) {
     System.exit(run(argv, System.out) + 95/*STATUS_TEMP*/);
  }
  public static int run(String argv[],PrintStream out) {
     name06801d d = new name06801d ();
     if ( ! d.check(out) ) {
        out.println("failed");
        return 2/*STATUS_FAILED*/;
     }
     return 0/*STATUS_PASSED*/;
  }
}

class name06801d extends name06801c {
   name06801d () { super(4); }
   name06801c c1;
   Class cl;
   boolean check (PrintStream out) { 
      try {
         cl = java.lang.Class.forName ("name06801.name06801a.name06801c");
      }
      catch (ClassNotFoundException e) {
         out.println(e);
         return false; 
      }
      try {
         c1 = (name06801c)cl.newInstance ();
      }
      catch (Exception e) {
         out.println(e);
         return true;
      }
      out.println(c1.n);
      return false; 
   }
}
--------------------------------------



======================================================================

Comments
EVALUATION Again, similar to 4007893, access checks are disabled when the class is loaded without a classloader, due to a bug in javac. sheng.liang@Eng 1997-07-21
21-07-1997