java - 使用反射完全妥协对普通 java 中方法的限制访问 - 为什么这是可能的？

Question

我完全困惑了 - 我用 Java8 SE 编写了一个类(不到 10 行代码)，它完全损害了使用反射的受限(私有(private))方法。我发现这非常危险，并质疑允许这样做的反射(reflection)意识。

package reflection;

import java.lang.reflect.Method;
import java.util.Arrays;

public class Reflection {

    //  Throw 'Throwable' because this method must be totally transparent, doing exactly what the actually called method does:
    static public Object call(Object target, String methodName, Object... args) throws Throwable {

        // Get the arguments' classes:
        Class<?>[] argumentClasses =
                Arrays.asList(args)
                    .stream()
                    .map(object -> object.getClass())
                    .toArray(Class[]::new);

        Method method = target.getClass().getDeclaredMethod(methodName, argumentClasses);
        method.setAccessible(true);
        return method.invoke(target, args);
    }

}

您可以运行此测试，它调用另一个类 Action 的私有(private)方法(静态和非静态):

package reflection;

import static org.junit.Assert.assertEquals;

import org.junit.Test;

public class ReflectionUnitTest {

    @Test
    public void testCall() throws Throwable {

        Action target = new Action();

        assertEquals("Something static done!", Reflection.call(target, "doSomethingStatic"));
        assertEquals("Something static done with something else!", Reflection.call(target, "doSomethingStatic", "something else"));
        assertEquals("Something static done 3 times with something else!", Reflection.call(target, "doSomethingStatic", 3, "something else"));
        assertEquals("Something static done 5 times with something else!", Reflection.call(target, "doSomethingStatic", "something else", 5));

        assertEquals("Something done!", Reflection.call(target, "doSomething"));
        assertEquals("Something done with something else!", Reflection.call(target, "doSomething", "something else"));
        assertEquals("Something done 3 times with something else!", Reflection.call(target, "doSomething", 3, "something else"));
        assertEquals("Something done 5 times with something else!", Reflection.call(target, "doSomething", "something else", 5));
    }

}


package reflection;

public class Action {

    static private String doSomethingStatic(){

        return "Something static done!";
    }

    private String doSomethingStatic(String argument) {

        return "Something static done with " + argument + "!";
    }

    private String doSomethingStatic(Integer count, String argument) {

        return "Something static done " + count + " times with " + argument + "!";
    }

    private String doSomethingStatic(String argument, Integer count) {

        return "Something static done " + count + " times with " + argument + "!";
    }


    private String doSomething() {

        return "Something done!";
    }

    private String doSomething(String argument) {

        return "Something done with " + argument + "!";
    }

    private String doSomething(Integer count, String argument) {

        return "Something done " + count + " times with " + argument + "!";
    }

    private String doSomething(String argument, Integer count) {

        return "Something done " + count + " times with " + argument + "!";
    }

}

我的问题:

1. 与您分享这些知识
2. 询问是否有人可以解释为什么这是可能的

Answer 1

问题不在于反射。

问题在于您的假设/期望。

让我解释一下:除非您的应用程序在您自己的物理硬件上运行，否则其他人也无法访问；除非您控制运行应用程序的系统上代码加载的所有方面……无论如何，控制都是一种幻觉。

如果您的类在不“属于”您的 JVM 上运行……人们无论如何都可以(几乎)做任何他们想做的事情。这只是努力的问题。

含义:Java 语言之父在某个时候启用了反射；无论好坏，他们决定允许您覆盖此保护(如果没有 SecurityManager)。但这不是什么新鲜事，从一开始就是这样。