Is reflection reliable?

Question

I am experimenting with PropertyChangeSupport , which has a useful firePropertyChange method. If security is a problem, is it safe to use reflection to invoke methods, as in the line below, or would it be preferable to simply query the method names hard? If reflection is a potential problem, how can this be prevented?

 method.invoke(instance, newValue); 

Answer 1

If security is a problem, is it safe to use reflection to invoke methods [...] or would it be preferable to just query the method names hard?

In general, it is preferable NOT to use reflection. Your application will be faster, easier (for example, fewer lines of code) and less fragile (for example, less likely to throw excluded exceptions) if you use regular (non-reflective) calls. It is best to use reflection when simpler approaches will not work.

Reflection safety is also a potential concern.

• If your JVM runs untrusted or unknown code that might try to do bad things, then reflection APIs generally offer many possibilities for creating bad things. For example, it allows bad code to invoke methods and access fields that the Java compiler will prevent. (It even allows code to do evil things, such as changing the value of final attributes and other things that are usually considered immutable.)

• Even if your JVM is running with fully trusted code, it is still possible that a design problem or a system security issue may allow the injection of a class or method name by a hacker. Then reflection APIs will obediently try to invoke unexpected methods.

If reflection is a potential problem, how can this be prevented?

It is easy. The application requires various permissions to successfully invoke the appropriate security-sensitive methods in the reflection API. These permissions are granted by default to trusted applications, not stand-alone applications. You can adjust them.

A simple solution: if you are using reliable code, or if you are concerned about the possibility of design errors that contain security, run all the relevant code in a security sandbox that prevents the use of the reflection API. (The disadvantage is that some third-party libraries are designed under the assumption that they can use reflection ... and will break into a sandbox.)

(Apparently, there is no verification of the actual call to Method.invoke(...) . Verification occurs earlier when the application code gets the Method object from Class .)

Answer 2

Depends on what you mean by "security." For contexts where there is untrusted code using trusted libraries, then most often there is some vulnerability. Otherwise, it's just bad code, which seems to have the same chance as introducing a vulnerability, like any other bad code.

Answer 3

Names of hard coding methods are preferable for performance, since when you call a method through reflection, there is additional overhead.

In security mode, you can turn off access checking for reflected objects so that you can use private and protected methods of other classes, if this is not prevented by the SecurityManager.