On Thu, 2 Jun 2022 15:19:44 GMT, Сергей Цыпанов <d...@openjdk.java.net> wrote:

>> The clone is needed - as the `List<Class<?>>` may be a custom implementation 
>> of List - so you cannot make any assumption on the concrete implementation 
>> of `toArray`.
> But we can make an assumption on the behavior of particular method and the 
> JavaDoc is clear about it. If a user passes an incorrect implementation of 
> the `List` interface then it's their own responsibility.

We can't rule out malicious code holding the array reference it returns in 
toArray and updates that array to cause damage.


PR: https://git.openjdk.java.net/jdk/pull/8923

Reply via email to