Feedback on proposal for #ReflectiveAccessToNonExportedTypes

[Simon Nash]

Paul Benedict wrote:
> For those who are still supporters of preventing non-exported types from
> being reflected, I think a compromise can still be found, but it's not in
> this proposal. Here are two other alternatives I hope the EG will consider:
> 
> 1) Introduce a new permission type to allow non-exported types to be
> reflected. I don't find it acceptable the module gets to dictate what can't
> be reflected. I believe this should be controlled and configured externally
> -- certainly not the module itself.
> 
> 2) Allow layers to control if non-exported types can be reflected. Perhaps
> the JDK sets its own layers to "false", but Containers and what they deploy
> can be separately configured, each. For example, maybe WebLogic won't allow
> itself to have its non-exported types reflected, but if each EAR gets its
> own layers, I could configure WebLogic to allow me to reflect everything
> within the EAR.
> 
> PS: I don't see #1 and #2 to be mutually exclusive.
> 
> Cheers,
> Paul
> 
I would like to propose another possible compromise that might satisfy both
of the following requirements that have been expressed on this thread:

1) My module should completely encapsulate some internal classes and make
    them invisible to the outside world

2) My module or library needs reflective access to internal classes in
    other modules in order to function correctly

At present, a module can mark its packages as:
  exported at compile time and runtime
  exported only at runtime via reflection
  never exported (the default)

Instead, these options could change to:
  exported at compile time and runtime
  exported at runtime only via reflection (the default)
  never exported (hidden)

This would allow modules to mark certain packages as "hidden" if these
packages contain internal methods or fields that should be never be
accessible externally under any circumstances.  The default would be
to allow reflection by other modules or libraries that need such access.

  Simon