java 反射 安全_java学习-反射-安全性检查

对于"java.lang.reflect.AccessibleObject",其子类包含 field / executable(java8,其子类包含 method/constructor);

/**

* Set the {@code accessible} flag for this object to

* the indicated boolean value. A value of {@code true} indicates that

* the reflected object should suppress Java language access

* checking when it is used. A value of {@code false} indicates

* that the reflected object should enforce Java language access checks.

*

*

First, if there is a security manager, its

* {@code checkPermission} method is called with a

* {@code ReflectPermission("suppressAccessChecks")} permission.

*

*

A {@code SecurityException} is raised if {@code flag} is

* {@code true} but accessibility of this object may not be changed

* (for example, if this element object is a {@link Constructor} object for

* the class {@link java.lang.Class}).

*

*

A {@code SecurityException} is raised if this object is a {@link

* java.lang.reflect.Constructor} object for the class

* {@code java.lang.Class}, and {@code flag} is true.

*

* @param flag the new value for the {@code accessible} flag

* @throws SecurityException if the request is denied.

* @see SecurityManager#checkPermission

* @see java.lang.RuntimePermission

*/

public void setAccessible(boolean flag) throws SecurityException {

SecurityManager sm = System.getSecurityManager();

if (sm != null) sm.checkPermission(ACCESS_PERMISSION);

setAccessible0(this, flag);

}

对于反射中的 AccessibleObject#setAccessible,当值为true时,作用实际是有两点

取消安全性检查,提高整体执行效率

避免了"illegalAccess"异常