SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 145

changes.mady.by.user Fred Long

Saved on

compared with

New Version 146

changes.mady.by.user Will Snavely

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Reflection enables a Java program to analyze and modify itself. In particular, a program can discover the values of field variables and change them [Forman 05], [Sun 02]. The Java reflection API includes a method that enables fields that are normally inaccessible to be accessed under reflection. The following code prints out the names and values of all fields of an object someObject of class SomeClass:

...

The following table lists the APIs that should be used with care [SCG 2009].

APIs that mirror language checks

java.lang.Class.newInstance()

java.lang.reflect.Constructor.newInstance()

java.lang.reflect.Field.get*()

java.lang.reflect.Field.set*()

java.lang.reflect.Method.invoke()

java.util.concurrent.atomic.AtomicIntegerFieldUpdater.newUpdater()

java.util.concurrent.atomic.AtomicLongFieldUpdater.newUpdater()

java.util.concurrent.atomic.AtomicReferenceFieldUpdater.newUpdater()

...

Reflection can be used on Android so the rule is applicable. Also the use of reflection may allow a developer to access private Android APIs and so requires caution.

Bibliography

[Chan 1999]

java.lang.reflect AccessibleObject

 

...

      Rule 15: Platform Security (SEC)Image Added