Changing a Field's Type in Recent JDKs
In this blog post, I want to share some findings regarding the security changes regarding changing a field's type across JDK versions.
Join the DZone community and get the full member experience.Join For Free
A couple of years ago, I attended a talk of my former colleague (but still friend) Volker Simonis. It gave me the idea to dig a bit into the subject of how to secure the JVM. From the material, I created a series of blog posts as well as a talk.
From that point on, I submitted the talk at meetups and conferences, where it was well-received. Because I like to explore different areas, I stopped to submit other proposals. Still, the talk is in my portfolio, and it was requested again in 2021. I have already presented it twice since the beginning of the year at the time of this writing.
It allowed me to update the demo with version 16 of the JDK. In this blog post, I want to share some findings regarding the security changes regarding changing a field's type across JDK versions.
Fun with JDK 8
Let's start with the JDK. Here's a quiz I show early in my talk:
Take some time to guess the result of executing this program when running it with a JDK 8.
Here's the relevant class diagram to help you:
As can be seen,
Field has a
type attribute that contains... its type. With the above code, one can change the type of
String so that the above code executes and prints
"This should print 5!".
With JDK 16, the snippet doesn't work anymore. It throws a runtime exception instead:
The exception explicitly mentions line 12:
Field.class.getDeclaredField("type"). It seems as if the implementation of the
Field class changed.
Looking at The Source Code of JDK 16
Let's look at the source code in JDK 16:
field type is there.
If the field is present, why do we get the exception? We need to dive a bit into the code to understand the reason.
Here's the sequence diagram of
The diagram reveals two interesting bits:
Reflectionclass manages a cache to improve performance.
- A field named
fieldFilterMapfilters out the fields that reflective access return.
Let's investigate the
Reflection class to understand the runtime doesn't find the
All of the
Field attributes are filtered out!
For this reason, none of the attributes of
Field are accessible via reflection!
An Alternative Way to Change the Type
Since version 9, the JDK offers a new API to access fields as part of the
Here's a quite simplified class diagram focusing on our usage:
One can use the API to access the
type attribute as above. The code looks like the following:
But running the code yields the following:
Though the code compiles and runs, it throws at
field.set(foo, "This should print 5!"). We reference the
type field and can change it without any issue, but it still complains.
The reason lies in the last line of the
Return a copy of the
Field object, not the
Since the JDK code returns a copy of the field, the change happens on this copy, and we cannot change the original field's type.
Though Java touts itself as a statically-typed language, version 8 of the JVM allows us to change the type at runtime dynamically. One of my favorite jokes during the talk mentioned above is that though we have learned that Java is statically typed, it is dynamically typed in reality.
We can track the change precisely in Java 12: version 11 of the
Reflection class shows a basic
fieldFilterMap; version 12 shows a fully configured one. Hence, if you want to avoid nasty surprises, you should upgrade to the latter, if not the latest.
To go further:
- Focus on JVM Security
- What does the sun.reflect.CallerSensitive annotation mean?
- Secure Coding Guidelines for Java SE
Orginally published at A Java Geek on April 4th, 2021.
Published at DZone with permission of Nicolas Fränkel, DZone MVB. See the original article here.
Opinions expressed by DZone contributors are their own.