/* $ javac -d . -XDignore.symbol.file=true IAE.java $ java -Xbootclasspath/a:. p1.IAE */ package p1; import jdk.internal.org.objectweb.asm.ClassWriter; import jdk.internal.org.objectweb.asm.MethodVisitor; import jdk.internal.org.objectweb.asm.Opcodes; import sun.misc.Unsafe; class T { static protected void test0() { System.out.println("test0 (public)"); } static protected void test1() { System.out.println("test1 (protected)"); } static /*package-private*/ void test2() { System.out.println("test2 (package)"); } static private void test3() { System.out.println("test3 (private)"); } } public class IAE { static Unsafe UNSAFE = Unsafe.getUnsafe(); static Class getAnonClass(Class hostClass, final String className) { final String superName = "java/lang/Object"; ClassWriter cw = new ClassWriter(ClassWriter.COMPUTE_MAXS + ClassWriter.COMPUTE_FRAMES); cw.visit(Opcodes.V1_8, Opcodes.ACC_PUBLIC + Opcodes.ACC_FINAL + Opcodes.ACC_SUPER, className, null, superName, null); MethodVisitor mv = cw.visitMethod(Opcodes.ACC_STATIC | Opcodes.ACC_PUBLIC, "test", "()V", null, null); mv.visitMethodInsn(Opcodes.INVOKESTATIC, "p1/T", "test0", "()V", false); mv.visitMethodInsn(Opcodes.INVOKESTATIC, "p1/T", "test1", "()V", false); mv.visitMethodInsn(Opcodes.INVOKESTATIC, "p1/T", "test2", "()V", false); mv.visitMethodInsn(Opcodes.INVOKESTATIC, "p1/T", "test3", "()V", false); mv.visitInsn(Opcodes.RETURN); mv.visitMaxs(0, 0); mv.visitEnd(); final byte[] classBytes = cw.toByteArray(); Class invokerClass = UNSAFE.defineAnonymousClass(hostClass, classBytes, new Object[0]); UNSAFE.ensureClassInitialized(invokerClass); return invokerClass; } public static void main(String[] args) throws Throwable { Throwable fail = null; // Anonymous class has the privileges of its host class, so test[0123] should all work. System.out.println("Injecting from the same package:"); Class p1cls = getAnonClass(IAE.class, "p1/AnonClass"); try { p1cls.getMethod("test").invoke(null); } catch (Throwable ex) { ex.printStackTrace(); fail = ex; // throw this to make test fail, since subtest failed } // Anonymous class has these privileges even if it is injected from a different package. System.out.println("Injecting from the wrong package:"); Class p2cls = getAnonClass(IAE.class, "p2/AnonClass"); try { p2cls.getMethod("test").invoke(null); } catch (Throwable ex) { ex.printStackTrace(); fail = ex; // throw this to make test fail, since subtest failed } // Inject a p1 class (easy to access p1.T), but into the p2 package. System.out.println("Injecting from the correct package into another package:"); Class p3cls = getAnonClass(p2cls, "p1/AnonClass"); try { p3cls.getMethod("test").invoke(null); } catch (Throwable ex) { ex.printStackTrace(); fail = ex; // throw this to make test fail, since subtest failed } if (fail != null) throw fail; // make test fail, since subtest failed } } /* EXPECTED OUTPUT: Injecting from the same package: test0 (public) test1 (protected) test2 (package) test3 (private) Injecting from the wrong package: test0 (public) test1 (protected) test2 (package) test3 (private) Injecting from the correct package into another package: test0 (public) test1 (protected) test2 (package) test3 (private) */ /* CURRENT ERRONEOUS OUTPUT: Injecting from the same package: test0 (public) test1 (protected) test2 (package) java.lang.reflect.InvocationTargetException at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:483) at p1.IAE.main(IAE.java:49) Caused by: java.lang.IllegalAccessError: tried to access method p1.T.test3()V from class p1.AnonClass/1309552426 at p1.AnonClass/1309552426.test(Unknown Source) ... 5 more Injecting from the wrong package: java.lang.reflect.InvocationTargetException at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:483) at p1.IAE.main(IAE.java:59) Caused by: java.lang.IllegalAccessError: tried to access class p1.T from class p2.AnonClass/705927765 at p2.AnonClass/705927765.test(Unknown Source) ... 5 more Injecting from the correct package into another package: test0 (public) test1 (protected) test2 (package) java.lang.reflect.InvocationTargetException at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:483) at p1.IAE.main(IAE.java:69) Caused by: java.lang.IllegalAccessError: tried to access method p1.T.test3()V from class p1.AnonClass/2018699554 at p1.AnonClass/2018699554.test(Unknown Source) ... 5 more Exception in thread "main" java.lang.reflect.InvocationTargetException at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:483) at p1.IAE.main(IAE.java:69) Caused by: java.lang.IllegalAccessError: tried to access method p1.T.test3()V from class p1.AnonClass/2018699554 at p1.AnonClass/2018699554.test(Unknown Source) ... 5 more */