Prevent reflective invocation of private methods in web dispatcher #35352
Conversation
Signed-off-by: yongjunhong <yongjunh@apache.org>
spring-projects-issues
added
the
status: waiting-for-triage
rstoyanchev
added
the
in: web
There was a problem hiding this comment.
I requested a few changes.
Please also take Rossen's comment into account.
|
|
||
| if (AopUtils.isCglibProxy(bean) && Modifier.isPrivate(method.getModifiers())) { | ||
| throw new IllegalStateException( | ||
| "Cannot invoke private method [" + method.getName() + "] on a CGLIB proxy. " + |
There was a problem hiding this comment.
It would probably be good to include context about the bean in the exception message as well.
| if (AopUtils.isCglibProxy(bean) && Modifier.isPrivate(method.getModifiers())) { | ||
| throw new IllegalStateException( | ||
| "Cannot invoke private method [" + method.getName() + "] on a CGLIB proxy. " + | ||
| "Handler methods on proxied components must be public or protected. " + |
There was a problem hiding this comment.
That's not completely true. It's possible for a package-private method to be proxied.
As stated in the reference documentation:
privatemethods cannot be advised, because they cannot be overridden.- Methods that are not visible – for example, package-private methods in a parent class from a different package – cannot be advised because they are effectively private.
...ng-web/src/test/java/org/springframework/web/method/support/InvocableHandlerMethodTests.java
Outdated
Show resolved
Hide resolved
...ng-web/src/test/java/org/springframework/web/method/support/InvocableHandlerMethodTests.java
Outdated
Show resolved
Hide resolved
sbrannen
added
the
status: waiting-for-feedback
|
I'm currently traveling, so I should be able to work on it around Wednesday or Thursday this week. |
spring-projects-issues
added
status: feedback-provided
Signed-off-by: yongjunhong <yongjunh@apache.org>
Signed-off-by: yongjunhong <yongjunh@apache.org>
Signed-off-by: yongjunhong <yongjunh@apache.org>
Please take a look :) |
|
If you have some time, I’d really appreciate it if you could take a look at this PR as well. 🙇🏻♂️🙇🏻♂️ It’s similar to the this PR, focusing on the access modifiers and proxies!! |
fixes #30938