JDK-6378384 : (reflect) subclass can���t access superclass���s protected fields and methods by reflection
  • Type: Bug
  • Component: core-libs
  • Sub-Component: java.lang:reflect
  • Affected Version: 5.0,6,7,8,9
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2006-01-30
  • Updated: 2016-10-27
  • Resolved: 2016-10-18
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 9
9 b142Fixed
Related Reports
Duplicate :  
Duplicate :  
Relates :  
Description
FULL PRODUCT VERSION :
java version "1.5.0_04"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_04-b05)
Java HotSpot(TM) Client VM (build 1.5.0_04-b05, mixed mode, sharing)
1.5.0_06-b05
1.6.0-rc-b68

A DESCRIPTION OF THE PROBLEM :
A subclass can't access its superclass's protected fields and methods by reflection.
Although I don't know the specification, I think there is a bug in sun.reflect.Reflection#verifyMemberAccess() method (sun/reflect/Reflection.java:142). I think the order of isSubclassOf() method's arguments is incorrect.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
javac b\SubClass.java
java b.SubClass

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
a.SuperClass.protectedStaticField
a.SuperClass.protectedStaticField
a.SuperClass.protectedStaticMethod()
a.SuperClass.protectedStaticMethod()
ACTUAL -
a.SuperClass.protectedStaticField
java.lang.IllegalAccessException: Class b.SubClass can not access a member of class a.SuperClass with modifiers "protected static"
        at sun.reflect.Reflection.ensureMemberAccess(Reflection.java:65)
        at java.lang.reflect.Field.doSecurityCheck(Field.java:954)
        at java.lang.reflect.Field.getFieldAccessor(Field.java:895)
        at java.lang.reflect.Field.get(Field.java:357)
        at b.SubClass.main(SubClass.java:8)
a.SuperClass.protectedStaticMethod()
java.lang.IllegalAccessException: Class b.SubClass can not access a member of class a.SuperClass with modifiers "protected static"
        at sun.reflect.Reflection.ensureMemberAccess(Reflection.java:65)
        at java.lang.reflect.Method.invoke(Method.java:578)
        at b.SubClass.main(SubClass.java:17)

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
-----
package a;

public class SuperClass {
    protected static String protectedStaticField = "a.SuperClass.protectedStaticField";

    protected static void protectedStaticMethod() {
        System.out.println("a.SuperClass.protectedStaticMethod()");
    }
}
-----
package b;

public class SubClass extends a.SuperClass {
    public static void main(String[] args) {
        System.out.println(protectedStaticField);

        try {
            System.out.println(a.SuperClass.class.getDeclaredField("protectedStaticField").get(null));
        } catch (Exception e) {
            e.printStackTrace();
        }
//Runtime Exception

        protectedStaticMethod();

        try {
            a.SuperClass.class.getDeclaredMethod("protectedStaticMethod").invoke(null);
        } catch (Exception e) {
            e.printStackTrace();
        }
//Runtime Exception
    }
}
-----
---------- END SOURCE ----------

Comments
Here's a fix with an exhaustive test for reflective access: http://cr.openjdk.java.net/~plevart/jdk9-dev/6378384_Reflection.ensureAccess/webrev.02/ Running the test on unpatched JDK 9: http://cr.openjdk.java.net/~plevart/jdk9-dev/6378384_Reflection.ensureAccess/AccessControlTest_unpatched.jtr Running it on patched: http://cr.openjdk.java.net/~plevart/jdk9-dev/6378384_Reflection.ensureAccess/AccessControlTest_patched.jtr
03-10-2016

This is not a strict duplicate of JDK-4032740 (Reflection)Accessibilities of members should be ACCESS-LEVEL sensitive. And I have a fix for it.
30-09-2016