src/java.base/share/classes/sun/invoke/util/VerifyAccess.java

*** 1,7 ****
  /*
!  * Copyright (c) 2008, 2013, Oracle and/or its affiliates. All rights reserved.
   * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   *
   * This code is free software; you can redistribute it and/or modify it
   * under the terms of the GNU General Public License version 2 only, as
   * published by the Free Software Foundation.  Oracle designates this
--- 1,7 ----
  /*
!  * Copyright (c) 2008, 2017, Oracle and/or its affiliates. All rights reserved.
   * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   *
   * This code is free software; you can redistribute it and/or modify it
   * under the terms of the GNU General Public License version 2 only, as
   * published by the Free Software Foundation.  Oracle designates this
*** 37,46 ****
--- 37,47 ----
   */
  public class VerifyAccess {
  
      private VerifyAccess() { }  // cannot instantiate
  
+     private static final int UNCONDITIONAL_ALLOWED = java.lang.invoke.MethodHandles.Lookup.UNCONDITIONAL;
      private static final int MODULE_ALLOWED = java.lang.invoke.MethodHandles.Lookup.MODULE;
      private static final int PACKAGE_ONLY = 0;
      private static final int PACKAGE_ALLOWED = java.lang.invoke.MethodHandles.Lookup.PACKAGE;
      private static final int PROTECTED_OR_PACKAGE_ALLOWED = (PACKAGE_ALLOWED|PROTECTED);
      private static final int ALL_ACCESS_MODES = (PUBLIC|PRIVATE|PROTECTED|PACKAGE_ONLY);
*** 90,100 ****
                                               int      mods,  // actual member mods
                                               Class<?> lookupClass,
                                               int      allowedModes) {
          if (allowedModes == 0)  return false;
          assert((allowedModes & PUBLIC) != 0 &&
!                (allowedModes & ~(ALL_ACCESS_MODES|PACKAGE_ALLOWED|MODULE_ALLOWED)) == 0);
          // The symbolic reference class (refc) must always be fully verified.
          if (!isClassAccessible(refc, lookupClass, allowedModes)) {
              return false;
          }
          // Usually refc and defc are the same, but verify defc also in case they differ.
--- 91,101 ----
                                               int      mods,  // actual member mods
                                               Class<?> lookupClass,
                                               int      allowedModes) {
          if (allowedModes == 0)  return false;
          assert((allowedModes & PUBLIC) != 0 &&
!                (allowedModes & ~(ALL_ACCESS_MODES|PACKAGE_ALLOWED|MODULE_ALLOWED|UNCONDITIONAL_ALLOWED)) == 0);
          // The symbolic reference class (refc) must always be fully verified.
          if (!isClassAccessible(refc, lookupClass, allowedModes)) {
              return false;
          }
          // Usually refc and defc are the same, but verify defc also in case they differ.
*** 171,181 ****
       */
      public static boolean isClassAccessible(Class<?> refc, Class<?> lookupClass,
                                              int allowedModes) {
          if (allowedModes == 0)  return false;
          assert((allowedModes & PUBLIC) != 0 &&
!                (allowedModes & ~(ALL_ACCESS_MODES|PACKAGE_ALLOWED|MODULE_ALLOWED)) == 0);
          int mods = getClassModifiers(refc);
          if (isPublic(mods)) {
  
              Module lookupModule = lookupClass.getModule();
              Module refModule = refc.getModule();
--- 172,182 ----
       */
      public static boolean isClassAccessible(Class<?> refc, Class<?> lookupClass,
                                              int allowedModes) {
          if (allowedModes == 0)  return false;
          assert((allowedModes & PUBLIC) != 0 &&
!                (allowedModes & ~(ALL_ACCESS_MODES|PACKAGE_ALLOWED|MODULE_ALLOWED|UNCONDITIONAL_ALLOWED)) == 0);
          int mods = getClassModifiers(refc);
          if (isPublic(mods)) {
  
              Module lookupModule = lookupClass.getModule();
              Module refModule = refc.getModule();
*** 189,214 ****
              // trivially allow
              if ((allowedModes & MODULE_ALLOWED) != 0 &&
                  (lookupModule == refModule))
                  return true;
  
!             // check readability
!             if (lookupModule.canRead(refModule)) {
  
                  // check that refc is in an exported package
-                 Class<?> c = refc;
-                 while (c.isArray()) {
-                     c = c.getComponentType();
-                 }
-                 if (c.isPrimitive())
-                     return true;
                  if ((allowedModes & MODULE_ALLOWED) != 0) {
!                     if (refModule.isExported(c.getPackageName(), lookupModule))
                          return true;
                  } else {
                      // exported unconditionally
!                     if (refModule.isExported(c.getPackageName()))
                          return true;
                  }
  
                  // not exported but allow access during VM initialization
                  // because java.base does not have its exports setup
--- 190,210 ----
              // trivially allow
              if ((allowedModes & MODULE_ALLOWED) != 0 &&
                  (lookupModule == refModule))
                  return true;
  
!             // check readability when UNCONDITIONAL not allowed
!             if (((allowedModes & UNCONDITIONAL_ALLOWED) != 0)
!                 || lookupModule.canRead(refModule)) {
  
                  // check that refc is in an exported package
                  if ((allowedModes & MODULE_ALLOWED) != 0) {
!                     if (refModule.isExported(refc.getPackageName(), lookupModule))
                          return true;
                  } else {
                      // exported unconditionally
!                     if (refModule.isExported(refc.getPackageName()))
                          return true;
                  }
  
                  // not exported but allow access during VM initialization
                  // because java.base does not have its exports setup