> On Sep 5, 2016, at 12:19 AM, Peter Levart <peter.lev...@gmail.com> wrote: > > I'm thinking of the Class::getDeclaredConstructor method. > > If the implClass's class loader is not the bootstrap loader, > "accessDeclaredMembers" permission will be checked. I don't know about which > implClass(es) will be passed to the method, but if custom user classes are > among them, they will not be loaded by bootstrap loader, right?
Yes, you’re right. I expect that the caller should call JavaNetSocketAccess::newSocketImpl with doPrivileged and itself has the proper permission. Mandy
