ObjectToObjectConverter should be able to use constructors on non-public classes [SPR-14304]

[spring-projects-issues]

Oliver Drotbohm opened SPR-14304 and commented

ObjectToObjectConverter makes factory methods accessible before invoking them, but doesn't do the same for constructor invocations.

---

Affects: 3.2.17, 4.2.6, 4.3 RC2

Referenced from: commits 9659bc5, 1e2b8ab, 17d6221, edf1df3

Backported to: 4.2.9, 3.2.18

[spring-projects-issues]

Martin Macko commented

I was looking into this and found out that getValidatedMember cannot return a private method or constructor. So makeAccessible doesn't make sense there.
I've submitted a PR with a test that proves this and removes makeAccessible from convert().

#1227

[spring-projects-issues]

Juergen Hoeller commented

While getValidatedMember will indeed only return a public method or constructor, such a member may be declared on a non-public (e.g. package visible) class provided by the application... which requires setAccessible(true) again. In that sense, the original request is valid here: We need to call makeAccessible for constructors as well, so we're doing this as of 4.3.4 / 4.2.9 now.

In any case, thanks for bringing this issue to my attention again! It seems to have got lost back then...

[spring-projects-issues]

Martin Macko commented

I didn't know that, good to know :)
I've closed the pull request and will write tests for this at least, as there are none now, if that's ok?

[spring-projects-issues]

Juergen Hoeller commented

DefaultConversionServiceTests had tests against private classes already but those weren't really effective since the test classes were colocated with the DefaultConversionService implementation class in the same package (so the default access rules in the JVM still considered it valid, even without an accessibility override). I moved those tests to a different package along with this fix last night, enforcing the need for setAccessible(true). In other words, with that test class in a different package, a few tests will fail if you comment out the makeAccessible calls now. So I guess we are covered there already. Thanks for volunteering, in any case!