[PATCH] ASTMethod / IllegalAccessException

[Stephane Bailliez <sb...@imediation.com>]

Hello,

I have run into a little problem while ..templating...

The idea was to do an iteration over 2 collections in sync as follows:

#macro (makeList $headings $data)
	#set ($it = $data.iterator())
	#foreach($heading in $headings)
		$heading $it.next()<br/>
	#end
#end

Because of the way the reflection is performed we can get
IllegalAccessException because we are working on a private class rather than
one of its interface or possibly public superclass. In the case above we are
working on java.util.AbstractList$Itr, while we would need to work on
java.util.Iterator

The ugly hack I did was the following:
It somewhat prevents huge security problem but not completely I guess.

int modifiers = method.getModifiers();
if ( Modifier.isPublic(modifiers) && !method.isAccessible() ){
	method.setAccessible(true);
}

It would probably be better to save the type of the object from a method
return type each time a method call is performed and work on this one.


I modified as well a line so that we have the full exception, it somewhat
bothered me when I ran into this problem since the stacktrace was swallowed
and I only got the message on System.out. This is not a good way to do
anyway since it would be nicer to log into the log rather than system out...

-- 
 Stéphane Bailliez 
 Software Engineer, Paris - France 
 iMediation - http://www.imediation.com 
 Disclaimer: All the opinions expressed above are mine and not those from my
company. 

Re: [PATCH] ASTMethod / IllegalAccessException

["Geir Magnusson Jr." <ge...@optonline.net>]

Stephane Bailliez wrote:
> 
> Hello,
> 
> I have run into a little problem while ..templating...
> 
> The idea was to do an iteration over 2 collections in sync as follows:
> 
> #macro (makeList $headings $data)
>         #set ($it = $data.iterator())
>         #foreach($heading in $headings)
>                 $heading $it.next()<br/>
>         #end
> #end
> 
> Because of the way the reflection is performed we can get
> IllegalAccessException because we are working on a private class rather than
> one of its interface or possibly public superclass. In the case above we are
> working on java.util.AbstractList$Itr, while we would need to work on
> java.util.Iterator

Which in the above gives you the IllegalAccessException? 

> 
> The ugly hack I did was the following:
> It somewhat prevents huge security problem but not completely I guess.
> 
> int modifiers = method.getModifiers();
> if ( Modifier.isPublic(modifiers) && !method.isAccessible() ){
>         method.setAccessible(true);
> }
> 
> It would probably be better to save the type of the object from a method
> return type each time a method call is performed and work on this one.

Eh.  Before making the statement "Velocity shouldn't change modifiers of
methods in the context", I am interested to see what classes you are
working with, and why the problem occurrs....

 
> I modified as well a line so that we have the full exception, it somewhat
> bothered me when I ran into this problem since the stacktrace was swallowed
> and I only got the message on System.out. This is not a good way to do
> anyway since it would be nicer to log into the log rather than system out...
> 

That we should be able to fix, the output...

geir

-- 
Geir Magnusson Jr.                           geirm@optonline.net
System and Software Consulting
Developing for the web?  See http://jakarta.apache.org/velocity/
Be well, do good work, and keep in touch.