changeset 7972:e14221289076

8000539: JMX implementation allows invocation of methods of a system class Summary: Added extra packageAccess check call Reviewed-by: ahgross, dfuchs Contributed-by: jaroslav.bachorik@oracle.com
author dsamersoff
date Tue, 30 Oct 2012 17:05:45 +0400
parents be07910b3fad
children 64440cc2ea8b
files src/share/classes/com/sun/jmx/mbeanserver/Introspector.java
diffstat 1 files changed, 6 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/classes/com/sun/jmx/mbeanserver/Introspector.java	Fri Oct 26 13:48:33 2012 -0700
+++ b/src/share/classes/com/sun/jmx/mbeanserver/Introspector.java	Tue Oct 30 17:05:45 2012 +0400
@@ -56,6 +56,8 @@
 import java.lang.reflect.InvocationTargetException;
 import javax.management.AttributeNotFoundException;
 import javax.management.openmbean.CompositeData;
+import sun.reflect.misc.MethodUtil;
+import sun.reflect.misc.ReflectUtil;
 
 /**
  * This class contains the methods for performing all the tests needed to verify
@@ -528,8 +530,10 @@
                     // to locate method
                     readMethod = SimpleIntrospector.getReadMethod(clazz, element);
                 }
-                if (readMethod != null)
-                    return readMethod.invoke(complex);
+                if (readMethod != null) {
+                    ReflectUtil.checkPackageAccess(readMethod.getDeclaringClass());
+                    return MethodUtil.invoke(readMethod, complex, new Class[0]);
+                }
 
                 throw new AttributeNotFoundException(
                     "Could not find the getter method for the property " +