Paul Benedict wrote:
For those who are still supporters of preventing non-exported types from
being reflected, I think a compromise can still be found, but it's not in
this proposal. Here are two other alternatives I hope the EG will consider:
1) Introduce a new permission type to allow non-exported types to be
reflected. I don't find it acceptable the module gets to dictate what can't
be reflected. I believe this should be controlled and configured externally
-- certainly not the module itself.
2) Allow layers to control if non-exported types can be reflected. Perhaps
the JDK sets its own layers to "false", but Containers and what they deploy
can be separately configured, each. For example, maybe WebLogic won't allow
itself to have its non-exported types reflected, but if each EAR gets its
own layers, I could configure WebLogic to allow me to reflect everything
within the EAR.
PS: I don't see #1 and #2 to be mutually exclusive.
Cheers,
Paul
I would like to propose another possible compromise that might satisfy both
of the following requirements that have been expressed on this thread:
1) My module should completely encapsulate some internal classes and make
them invisible to the outside world
2) My module or library needs reflective access to internal classes in
other modules in order to function correctly
At present, a module can mark its packages as:
exported at compile time and runtime
exported only at runtime via reflection
never exported (the default)
Instead, these options could change to:
exported at compile time and runtime
exported at runtime only via reflection (the default)
never exported (hidden)
This would allow modules to mark certain packages as "hidden" if these
packages contain internal methods or fields that should be never be
accessible externally under any circumstances. The default would be
to allow reflection by other modules or libraries that need such access.
Simon
