CallerSensitive access rights problems

Peter Levart peter.levart at
Mon Nov 18 16:36:50 UTC 2013

On 11/18/2013 04:31 PM, Alan Bateman wrote:
> On 18/11/2013 14:59, Jochen Theodorou wrote:
>> Hi,
>> java.lang.Class has multiple methods annotated with CallerSensitive 
>> (see 
>> Now if we in Groovy here want to build our runtime structure for this 
>> class, and the security manager is not allowing access to 
>> sun.reflect, then we get into trouble. 
>> is caused by this.
>> What do you suggest people with this problem, if adding 
>> accessClassInPackage.sun.reflect is no option?
> Is it sun.reflect.CallerSensitive.class.getDeclaredMethods that is 
> failing?
> -Alan.

 From GROOVY-6405 discussion I think it is, yes.

The work-around suggested in GROOVY-6405 does not work, because it has a 
bug. It should be written as:

     private static void setAnnotationMetaData(Annotation[] annotations 
/*, AnnotatedNode an */) {
         for (Annotation annotation : annotations) {
             if (annotation*.annotationType()*.getPackage() == null ||
                 System.out.println("Processing: " + 
             } else {
                 System.out.println("Skipping: " + 

... i.e. don't call annotation.*getClass()* because what you get is a 
dynamic Proxy class implementing the annotation interface and such Proxy 
class does not live in the same package as the annotation interface...

There is another such annotation to watch for, in another protected 
package: *sun.misc.Contended* ...

Regards, Peter

More information about the core-libs-dev mailing list