Stealing MethodHandle.Lookup object via private constructor allows non-privileged access across module boundary

XMLWordPrintable

    • Type: Bug
    • Resolution: Not an Issue
    • Priority: P2
    • 9
    • Affects Version/s: 9
    • Component/s: core-libs

      Current module boundary is enforced by setAccessible(true) throwing exceptions on privileged contructors/methods/fields. This allows to hide implementations within the module, e.g. jdk.vm.internal.Unsafe.

      However, this does not seem to work if we are able to steal MH.Lookup object first, and resolve against it. See the attached test case for the example. Reproduces fine on JDK 9 b128.

            Assignee:
            Alan Bateman
            Reporter:
            Aleksey Shipilev
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: