<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<font size="4"><font face="monospace">Received on the -comments
list. <br>
<br>
Yes, this issue is well understood; I believe John has written
about this on the -experts list already, or if not he will
soon. Reflection frequently has to bake back in access control
checks that otherwise would be done by the VM during linkage,
and many reflective methods are caller-sensitive for exactly
this reason. <br>
<br>
Do you have any reason to believe that the standard techniques
of securing reflection would result in problems? <br>
</font></font>
<div class="moz-forward-container"><br>
<br>
-------- Forwarded Message --------
<table class="moz-email-headers-table" cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Subject:
</th>
<td>What about Array.newInstance for restricted value-types?</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Date: </th>
<td>Tue, 26 Jul 2022 14:38:05 +0200</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">From: </th>
<td>Gernot Neppert <a class="moz-txt-link-rfc2396E" href="mailto:mcnepp02@googlemail.com"><mcnepp02@googlemail.com></a></td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">To: </th>
<td><a class="moz-txt-link-abbreviated" href="mailto:valhalla-spec-comments@openjdk.java.net">valhalla-spec-comments@openjdk.java.net</a></td>
</tr>
</tbody>
</table>
<br>
<br>
<br>
There is an ongoing discussion about how to prevent the creation
of values with non-sensible zero-defaults.<br>
<br>
Currently, the consensus seems to be that restricting access to a
value-type's "companion-type" will achieve this.<br>
<br>
However, I found this Anomaly:<br>
<br>
The method java.lang.reflect.Array.newInstance(Class<?>
componentType,int length) currently does not take the
accessibility of the "componentType" into account!<br>
<br>
So, it looks as if one could still create flat, zero-initialized
arrays of private companion-types from anywhere in the codebase:<br>
<br>
package org.secrets;<br>
<br>
public value class Bar {<br>
<br>
private value companion Bar.val;<br>
<br>
}<br>
<br>
package com.external;<br>
<br>
import java.lang.reflect.Array;<br>
<br>
public class Main {<br>
<br>
Bar[] bars =
(Bar[])Array.newInstance(Class.forName("org.secrets.Bar.val"),
42);<br>
<br>
}<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</div>
</body>
</html>