Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8162460

Stealing MethodHandle.Lookup object via private constructor allows non-privileged access across module boundary

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not an Issue
    • Icon: P2 P2
    • 9
    • 9
    • core-libs

      Current module boundary is enforced by setAccessible(true) throwing exceptions on privileged contructors/methods/fields. This allows to hide implementations within the module, e.g. jdk.vm.internal.Unsafe.

      However, this does not seem to work if we are able to steal MH.Lookup object first, and resolve against it. See the attached test case for the example. Reproduces fine on JDK 9 b128.

            alanb Alan Bateman
            shade Aleksey Shipilev
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: