On Mon, 26 Oct 2026 06:54:37 GMT, Alan Bateman <[email protected]> wrote:
> sun.reflect.ReflectionFactory was added in JDK 1.4 as JDK-internal > infrastructure for Java serialization. Over time, third-party libraries used > it to implement serialization mechanisms with behavior similar to Java > serialization. This lead to JEP 260 recognizing sun.reflect.ReflectionFactory > as a "critical internal API" to remain accessible in JDK 9. > > The 1-arg newConstructorForSerialization method is used to taking a > serializable class, find the nearest superclass that is not serializable, and > return the no-arg constructor of that superclass. This constructor is > important in the canonical operation of deserialization. This method has a > bug in that it fails to check that its argument class implements > java.io.Serializable. > > The 2-arg newConstructorForSerialization was developed as a JDK-internal > utility method. It was declared public only incidentally, to allow use by > parts of the JDK outside sun.reflect. It was never intended as a supported > API for third-party libraries. It fails to check that its argument class > implements java.io.Serializable, and also that its argument constructor is a > no-arg constructor. > > The 1-arg newConstructorForSerialization is changed to return null when > invoked with a class that does not implement java.io.Serializable. The 2-arg > newConstructorForSerialization is deprecated or removal and its > implementation changed to throw UnsupportedOperationException by default. A > system property can is introduced to restore legacy and > undocumented/unsupporrted behavior to give method for anything using these > method to migrate. > > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). Marked as reviewed by liach (Reviewer). ------------- PR Review: https://git.openjdk.org/jdk/pull/33561#pullrequestreview-5672359276
