8000539: JMX implementation allows invocation of methods of a system class
Added extra packageAccess check call Reviewed-by: ahgross, dfuchs
This commit is contained in:
parent
df49c04239
commit
526b1f405c
@ -56,6 +56,8 @@ import java.lang.reflect.Array;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import javax.management.AttributeNotFoundException;
|
||||
import javax.management.openmbean.CompositeData;
|
||||
import sun.reflect.misc.MethodUtil;
|
||||
import sun.reflect.misc.ReflectUtil;
|
||||
|
||||
/**
|
||||
* This class contains the methods for performing all the tests needed to verify
|
||||
@ -528,8 +530,10 @@ public class Introspector {
|
||||
// to locate method
|
||||
readMethod = SimpleIntrospector.getReadMethod(clazz, element);
|
||||
}
|
||||
if (readMethod != null)
|
||||
return readMethod.invoke(complex);
|
||||
if (readMethod != null) {
|
||||
ReflectUtil.checkPackageAccess(readMethod.getDeclaringClass());
|
||||
return MethodUtil.invoke(readMethod, complex, new Class[0]);
|
||||
}
|
||||
|
||||
throw new AttributeNotFoundException(
|
||||
"Could not find the getter method for the property " +
|
||||
|
Loading…
x
Reference in New Issue
Block a user