Use privileged action to instantiate LiteExtensionTranslator.

Replace remaining usages of long deprecated Class#newInstance() with getDeclaredConstructor().newInstance().
weld · May 15, 2024 · 05492ba · 05492ba
1 parent efc76a3
commit 05492ba
Show file tree

Hide file tree

Showing 16 changed files with 89 additions and 34 deletions.
diff --git a/...src/main/java/org/jboss/weld/environment/deployment/discovery/jandex/SecurityActions.java b/...src/main/java/org/jboss/weld/environment/deployment/discovery/jandex/SecurityActions.java
@@ -22,6 +22,7 @@
 
 import org.jboss.weld.exceptions.WeldException;
 import org.jboss.weld.security.ConstructorNewInstanceAction;
+import org.jboss.weld.security.GetDeclaredConstructorAction;
 import org.jboss.weld.security.NewInstanceAction;
 
 /**
@@ -38,15 +39,17 @@ private SecurityActions() {
      * @throws InstantiationException
      * @throws IllegalAccessException
      */
-    static <T> T newInstance(Class<T> javaClass) throws InstantiationException, IllegalAccessException {
+    static <T> T newInstance(Class<T> javaClass)
+            throws InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {
         if (System.getSecurityManager() != null) {
             try {
-                return AccessController.doPrivileged(NewInstanceAction.of(javaClass));
+                return AccessController.doPrivileged(
+                        NewInstanceAction.of(AccessController.doPrivileged(GetDeclaredConstructorAction.of(javaClass))));
             } catch (PrivilegedActionException e) {
                 throw new WeldException(e.getCause());
             }
         } else {
-            return javaClass.newInstance();
+            return javaClass.getDeclaredConstructor().newInstance();
         }
     }
 

diff --git a/environments/common/src/main/java/org/jboss/weld/environment/util/SecurityActions.java b/environments/common/src/main/java/org/jboss/weld/environment/util/SecurityActions.java
@@ -16,10 +16,12 @@
  */
 package org.jboss.weld.environment.util;
 
+import java.lang.reflect.InvocationTargetException;
 import java.security.AccessController;
 import java.security.PrivilegedActionException;
 
 import org.jboss.weld.exceptions.WeldException;
+import org.jboss.weld.security.GetDeclaredConstructorAction;
 import org.jboss.weld.security.NewInstanceAction;
 
 /**
@@ -38,15 +40,17 @@ private SecurityActions() {
      * @throws InstantiationException
      * @throws IllegalAccessException
      */
-    static <T> T newInstance(Class<T> javaClass) throws InstantiationException, IllegalAccessException {
+    static <T> T newInstance(Class<T> javaClass)
+            throws InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {
         if (System.getSecurityManager() != null) {
             try {
-                return AccessController.doPrivileged(NewInstanceAction.of(javaClass));
+                return AccessController.doPrivileged(
+                        NewInstanceAction.of(AccessController.doPrivileged(GetDeclaredConstructorAction.of(javaClass))));
             } catch (PrivilegedActionException e) {
                 throw new WeldException(e.getCause());
             }
         } else {
-            return javaClass.newInstance();
+            return javaClass.getDeclaredConstructor().newInstance();
         }
     }
 

diff --git a/environments/se/core/src/main/java/org/jboss/weld/environment/se/SecurityActions.java b/environments/se/core/src/main/java/org/jboss/weld/environment/se/SecurityActions.java
@@ -16,11 +16,14 @@
  */
 package org.jboss.weld.environment.se;
 
+import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 
 import org.jboss.weld.exceptions.WeldException;
+import org.jboss.weld.security.GetDeclaredConstructorAction;
 import org.jboss.weld.security.NewInstanceAction;
 
 /**
@@ -39,15 +42,39 @@ private SecurityActions() {
      * @throws InstantiationException
      * @throws IllegalAccessException
      */
-    static <T> T newInstance(Class<T> javaClass) throws InstantiationException, IllegalAccessException {
+    static <T> T newInstance(Class<T> javaClass)
+            throws InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {
         if (System.getSecurityManager() != null) {
             try {
-                return AccessController.doPrivileged(NewInstanceAction.of(javaClass));
+                Constructor<T> constructor = AccessController.doPrivileged(GetDeclaredConstructorAction.of(javaClass));
+                return AccessController.doPrivileged(NewInstanceAction.of(constructor));
             } catch (PrivilegedActionException e) {
                 throw new WeldException(e.getCause());
             }
         } else {
-            return javaClass.newInstance();
+            return javaClass.getDeclaredConstructor().newInstance();
+        }
+    }
+
+    static <T> Constructor<T> getDeclaredConstructor(Class<T> javaClass, Class<?>... parameterTypes)
+            throws NoSuchMethodException, PrivilegedActionException {
+        if (System.getSecurityManager() != null) {
+            return AccessController.doPrivileged(GetDeclaredConstructorAction.of(javaClass, parameterTypes));
+        } else {
+            return javaClass.getDeclaredConstructor(parameterTypes);
+        }
+    }
+
+    static <T> T newInstance(Constructor<T> constructor, Object... params)
+            throws InstantiationException, IllegalAccessException, InvocationTargetException {
+        if (System.getSecurityManager() != null) {
+            try {
+                return AccessController.doPrivileged(NewInstanceAction.of(constructor, params));
+            } catch (PrivilegedActionException e) {
+                throw new WeldException(e.getCause());
+            }
+        } else {
+            return constructor.newInstance(params);
         }
     }
 

diff --git a/environments/se/core/src/main/java/org/jboss/weld/environment/se/Weld.java b/environments/se/core/src/main/java/org/jboss/weld/environment/se/Weld.java
@@ -1153,7 +1153,8 @@ protected Iterable<Metadata<Extension>> getExtensions() {
         if (!allBce.isEmpty()) {
             try {
                 result.add(new MetadataImpl<Extension>(
-                        new LiteExtensionTranslator(allBce, Thread.currentThread().getContextClassLoader()),
+                        SecurityActions.newInstance(SecurityActions.getDeclaredConstructor(LiteExtensionTranslator.class,
+                                Collection.class, ClassLoader.class), allBce, Thread.currentThread().getContextClassLoader()),
                         SYNTHETIC_LOCATION_PREFIX + LiteExtensionTranslator.class.getName()));
             } catch (Exception e) {
                 throw new RuntimeException(e);

diff --git a/...nments/servlet/core/src/main/java/org/jboss/weld/environment/servlet/SecurityActions.java b/...nments/servlet/core/src/main/java/org/jboss/weld/environment/servlet/SecurityActions.java
@@ -24,6 +24,7 @@
 
 import org.jboss.weld.exceptions.WeldException;
 import org.jboss.weld.security.ConstructorNewInstanceAction;
+import org.jboss.weld.security.GetDeclaredConstructorAction;
 import org.jboss.weld.security.MethodLookupAction;
 import org.jboss.weld.security.NewInstanceAction;
 
@@ -41,15 +42,17 @@ private SecurityActions() {
      * @throws InstantiationException
      * @throws IllegalAccessException
      */
-    static <T> T newInstance(Class<T> javaClass) throws InstantiationException, IllegalAccessException {
+    static <T> T newInstance(Class<T> javaClass)
+            throws InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {
         if (System.getSecurityManager() != null) {
             try {
-                return AccessController.doPrivileged(NewInstanceAction.of(javaClass));
+                return AccessController.doPrivileged(
+                        NewInstanceAction.of(AccessController.doPrivileged(GetDeclaredConstructorAction.of(javaClass))));
             } catch (PrivilegedActionException e) {
                 throw new WeldException(e.getCause());
             }
         } else {
-            return javaClass.newInstance();
+            return javaClass.getDeclaredConstructor().newInstance();
         }
     }
 

diff --git a/impl/src/main/java/org/jboss/weld/bean/proxy/DecorationHelper.java b/impl/src/main/java/org/jboss/weld/bean/proxy/DecorationHelper.java
@@ -17,6 +17,7 @@
 
 package org.jboss.weld.bean.proxy;
 
+import java.lang.reflect.InvocationTargetException;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.LinkedList;
@@ -128,7 +129,7 @@ public DecoratorProxyMethodHandler createMethodHandler(InjectionPoint injectionP
     public T run() {
         try {
             return instantiator.newInstance(proxyClassForDecorator);
-        } catch (InstantiationException e) {
+        } catch (InstantiationException | NoSuchMethodException | InvocationTargetException e) {
             throw new DefinitionException(BeanLogger.LOG.proxyInstantiationFailed(this), e.getCause());
         } catch (IllegalAccessException e) {
             throw new DefinitionException(BeanLogger.LOG.proxyInstantiationBeanAccessFailed(this), e.getCause());

diff --git a/impl/src/main/java/org/jboss/weld/bean/proxy/DefaultProxyInstantiator.java b/impl/src/main/java/org/jboss/weld/bean/proxy/DefaultProxyInstantiator.java
@@ -17,6 +17,7 @@
 package org.jboss.weld.bean.proxy;
 
 import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Modifier;
 
 import jakarta.enterprise.inject.spi.Bean;
@@ -39,8 +40,9 @@ private DefaultProxyInstantiator() {
     }
 
     @Override
-    public <T> T newInstance(Class<T> clazz) throws InstantiationException, IllegalAccessException {
-        return clazz.newInstance();
+    public <T> T newInstance(Class<T> clazz)
+            throws InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {
+        return clazz.getDeclaredConstructor().newInstance();
     }
 
     @Override

diff --git a/impl/src/main/java/org/jboss/weld/bean/proxy/ProxyFactory.java b/impl/src/main/java/org/jboss/weld/bean/proxy/ProxyFactory.java
@@ -25,6 +25,7 @@
 import java.io.IOException;
 import java.io.Serializable;
 import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.lang.reflect.Type;
@@ -386,7 +387,7 @@ public T run() {
                 return newInstantiator.newInstance(proxyClass);
             }
             return proxyInstantiator.newInstance(proxyClass);
-        } catch (InstantiationException e) {
+        } catch (InstantiationException | NoSuchMethodException | InvocationTargetException e) {
             throw new DefinitionException(BeanLogger.LOG.proxyInstantiationFailed(this), e.getCause());
         } catch (IllegalAccessException e) {
             throw new DefinitionException(BeanLogger.LOG.proxyInstantiationBeanAccessFailed(this), e.getCause());

diff --git a/impl/src/main/java/org/jboss/weld/bean/proxy/ProxyInstantiator.java b/impl/src/main/java/org/jboss/weld/bean/proxy/ProxyInstantiator.java
@@ -17,6 +17,7 @@
 package org.jboss.weld.bean.proxy;
 
 import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
 import java.util.List;
 
 import jakarta.enterprise.inject.spi.Bean;
@@ -34,7 +35,7 @@
 /**
  * Implementations of this interface are capable of creating instances of a given proxy class. This can either be done simply by
  * calling
- * {@link Class#newInstance()} or using more advanced mechanism (e.g. sun.misc.Unsafe)
+ * {@code clazz.getDeclaredConstructor().newInstance()} or using more advanced mechanism (e.g. sun.misc.Unsafe)
  *
  * @author Jozef Hartinger
  *
@@ -52,7 +53,8 @@ public interface ProxyInstantiator extends Service {
      * @param clazz the class
      * @return an instance of a proxy class
      */
-    <T> T newInstance(Class<T> clazz) throws InstantiationException, IllegalAccessException;
+    <T> T newInstance(Class<T> clazz)
+            throws InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException;
 
     /**
      * Validate, whether the given constructor is sufficient for a class to be proxyable.
@@ -137,7 +139,7 @@ public static ProxyInstantiator create(WeldConfiguration configuration) {
         }
 
         private static ProxyInstantiator newInstance(String implementation)
-                throws InstantiationException, IllegalAccessException {
+                throws InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {
             if (DefaultProxyInstantiator.class.getName().equals(implementation)) {
                 return DefaultProxyInstantiator.INSTANCE;
             }
@@ -146,7 +148,7 @@ private static ProxyInstantiator newInstance(String implementation)
             if (clazz == null) {
                 throw new WeldException("Unable to load ProxyInstantiator implementation: " + implementation);
             }
-            return clazz.newInstance();
+            return clazz.getDeclaredConstructor().newInstance();
         }
     }
 

diff --git a/impl/src/main/java/org/jboss/weld/injection/Exceptions.java b/impl/src/main/java/org/jboss/weld/injection/Exceptions.java
@@ -23,6 +23,7 @@
 import jakarta.enterprise.inject.CreationException;
 
 import org.jboss.weld.exceptions.WeldException;
+import org.jboss.weld.security.GetDeclaredConstructorAction;
 import org.jboss.weld.security.NewInstanceAction;
 
 class Exceptions {
@@ -36,8 +37,8 @@ private static void rethrowException(Throwable t, Class<? extends RuntimeExcepti
         } else {
             RuntimeException e;
             try {
-
-                e = AccessController.doPrivileged(NewInstanceAction.of(exceptionToThrow));
+                e = AccessController.doPrivileged(
+                        NewInstanceAction.of(AccessController.doPrivileged(GetDeclaredConstructorAction.of(exceptionToThrow))));
             } catch (PrivilegedActionException ex) {
                 throw new WeldException(ex.getCause());
             }

diff --git a/impl/src/main/java/org/jboss/weld/security/NewInstanceAction.java b/impl/src/main/java/org/jboss/weld/security/NewInstanceAction.java
@@ -16,20 +16,27 @@
  */
 package org.jboss.weld.security;
 
+import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
 import java.security.PrivilegedExceptionAction;
 
 public class NewInstanceAction<T> extends AbstractGenericReflectionAction<T> implements PrivilegedExceptionAction<T> {
 
-    public static <T> NewInstanceAction<T> of(Class<T> javaClass) {
-        return new NewInstanceAction<T>(javaClass);
+    public static <T> NewInstanceAction<T> of(Constructor<T> constructor, Object... params) {
+        return new NewInstanceAction<T>(constructor, params);
     }
 
-    public NewInstanceAction(Class<T> javaClass) {
-        super(javaClass);
+    private final Constructor<T> constructor;
+    private final Object[] params;
+
+    public NewInstanceAction(Constructor<T> constructor, Object... params) {
+        super(constructor.getDeclaringClass());
+        this.constructor = constructor;
+        this.params = params;
     }
 
     @Override
-    public T run() throws InstantiationException, IllegalAccessException {
-        return javaClass.newInstance();
+    public T run() throws InvocationTargetException, InstantiationException, IllegalAccessException {
+        return constructor.newInstance(params);
     }
 }
diff --git a/impl/src/test/java/org/jboss/weld/tests/unit/security/ReflectionTest.java b/impl/src/test/java/org/jboss/weld/tests/unit/security/ReflectionTest.java
@@ -197,7 +197,8 @@ public void testConstructorAccess() {
 
     @Test
     public void testNewInstance() throws PrivilegedActionException {
-        Assert.assertNotNull(AccessController.doPrivileged(NewInstanceAction.of(TestObject.class)));
+        Assert.assertNotNull(AccessController.doPrivileged(
+                NewInstanceAction.of(AccessController.doPrivileged(GetDeclaredConstructorAction.of(TestObject.class)))));
     }
 
     @Test

diff --git a/modules/ejb/src/main/java/org/jboss/weld/module/ejb/SessionBeanProxyInstantiator.java b/modules/ejb/src/main/java/org/jboss/weld/module/ejb/SessionBeanProxyInstantiator.java
@@ -31,6 +31,7 @@
 import org.jboss.weld.injection.producer.Instantiator;
 import org.jboss.weld.logging.BeanLogger;
 import org.jboss.weld.manager.BeanManagerImpl;
+import org.jboss.weld.security.GetDeclaredConstructorAction;
 import org.jboss.weld.security.NewInstanceAction;
 
 /**
@@ -51,7 +52,8 @@ class SessionBeanProxyInstantiator<T> implements Instantiator<T> {
     @Override
     public T newInstance(CreationalContext<T> ctx, BeanManagerImpl manager) {
         try {
-            T instance = AccessController.doPrivileged(NewInstanceAction.of(proxyClass));
+            T instance = AccessController.doPrivileged(
+                    NewInstanceAction.of(AccessController.doPrivileged(GetDeclaredConstructorAction.of(proxyClass))));
             if (!bean.getScope().equals(Dependent.class)) {
                 ctx.push(instance);
             }

diff --git a/...illian/src/test/java/org/jboss/weld/tests/interceptors/extension/AbstractInterceptor.java b/...illian/src/test/java/org/jboss/weld/tests/interceptors/extension/AbstractInterceptor.java
@@ -71,7 +71,7 @@ public Set<InjectionPoint> getInjectionPoints() {
     @SuppressWarnings("unchecked")
     public T create(CreationalContext<T> creationalContext) {
         try {
-            return (T) getBeanClass().newInstance();
+            return (T) getBeanClass().getDeclaredConstructor().newInstance();
         } catch (Exception e) {
             throw new RuntimeException("Error creating an instance of " + getBeanClass());
         }

diff --git a/tests-arquillian/src/test/java/org/jboss/weld/tests/interceptors/lhotse/fst/GenericDAO.java b/tests-arquillian/src/test/java/org/jboss/weld/tests/interceptors/lhotse/fst/GenericDAO.java
@@ -45,7 +45,7 @@ public <U> U find(Class<U> clazz, Long id) {
             throw new IllegalArgumentException("Null id");
 
         try {
-            return clazz.newInstance();
+            return clazz.getDeclaredConstructor().newInstance();
         } catch (Exception e) {
             throw new RuntimeException(e);
         }

diff --git a/tests-arquillian/src/test/java/org/jboss/weld/tests/interceptors/tb/GenericDAO.java b/tests-arquillian/src/test/java/org/jboss/weld/tests/interceptors/tb/GenericDAO.java
@@ -47,7 +47,7 @@ public <U> U find(Class<U> clazz, Long id) {
             throw new IllegalArgumentException("No Tx marker!");
 
         try {
-            return clazz.newInstance();
+            return clazz.getDeclaredConstructor().newInstance();
         } catch (Exception e) {
             throw new RuntimeException(e);
         }