Prevent reflective invocation of private methods in web dispatcher #35352

YongGoose · 2025-08-20T01:48:54Z

fixes #30938

Signed-off-by: yongjunhong <[email protected]>

rstoyanchev

Couldn't this be checked in RequestMappingHandlerMapping when request mappings are being initialized?

It would avoid repeating that on every call.

sbrannen

I requested a few changes.

Please also take Rossen's comment into account.

spring-web/src/main/java/org/springframework/web/method/support/InvocableHandlerMethod.java

...ng-web/src/test/java/org/springframework/web/method/support/InvocableHandlerMethodTests.java

YongGoose · 2025-10-06T04:54:47Z

I'm currently traveling, so I should be able to work on it around Wednesday or Thursday this week.
@rstoyanchev @sbrannen Thank you both so much for the great reviews! 🙇🏻‍♂️

Signed-off-by: yongjunhong <[email protected]>

YongGoose · 2025-10-09T05:41:50Z

Couldn't this be checked in RequestMappingHandlerMapping when request mappings are being initialized?

It would avoid repeating that on every call.

Please take a look :)

72ff98a

YongGoose · 2025-10-09T06:02:24Z

@sbrannen @rstoyanchev

If you have some time, I’d really appreciate it if you could take a look at this PR as well. 🙇🏻‍♂️🙇🏻‍♂️

Fall back to JDK proxy if CGLIB proxy creation fails #35344

It’s similar to the this PR, focusing on the access modifiers and proxies!!

sbrannen

Thanks for making the requested changes. It's looking better. 👍

I've requested a few additional changes in this follow up review.

Also, please make analogous changes to org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerMapping and org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerMappingTests.

sbrannen · 2025-10-10T15:35:53Z

...java/org/springframework/web/servlet/mvc/method/annotation/RequestMappingHandlerMapping.java

+					String methodPackageName = (methodPackage != null) ? methodPackage.getName() : "default package";
+					String handlerPackageName = (handlerPackage != null) ? handlerPackage.getName() : "default package";


I don't believe java.lang.Package.getName() can return null on Java 17.

sbrannen · 2025-10-10T15:36:36Z

...java/org/springframework/web/servlet/mvc/method/annotation/RequestMappingHandlerMapping.java

+					throw new IllegalStateException(
+							"Package-private method [" + method + "] on CGLIB proxy class [" + declaringClass.getName() +
+									"] from package [" + methodPackageName + "] cannot be advised when used by handler class [" +
+									handlerType.getName() + "] from package [" + handlerPackageName + "] because it is effectively private. " +
+									"Either make the method public/protected or use interface-based JDK proxying instead.");
+				}


Please introduce a test for this.

Done in dba200f !

sbrannen · 2025-10-10T15:37:03Z

...ng-web/src/test/java/org/springframework/web/method/support/InvocableHandlerMethodTests.java

-
-

Please revert all unnecessary changes to this file.

sbrannen · 2025-10-10T15:38:29Z

...java/org/springframework/web/servlet/mvc/method/annotation/RequestMappingHandlerMapping.java

 	protected @Nullable RequestMappingInfo getMappingForMethod(Method method, Class<?> handlerType) {
+		int modifiers = method.getModifiers();
+
+		if (isCglibProxy(handlerType)) {


I think it would be better if we extract this new CGLIB-proxy validation to a separate helper method in order not to clutter getMappingForMethod().

...java/org/springframework/web/servlet/mvc/method/annotation/RequestMappingHandlerMapping.java

...org/springframework/web/servlet/mvc/method/annotation/RequestMappingHandlerMappingTests.java

…c/method/annotation/RequestMappingHandlerMapping.java Co-authored-by: Sam Brannen <[email protected]> Signed-off-by: Yongjun Hong <[email protected]>

…c/method/annotation/RequestMappingHandlerMappingTests.java Co-authored-by: Sam Brannen <[email protected]> Signed-off-by: Yongjun Hong <[email protected]>

Signed-off-by: yongjunhong <[email protected]>

…related tests Signed-off-by: yongjunhong <[email protected]>

Signed-off-by: yongjunhong <[email protected]>

Prevent reflective invocation of private methods in web dispatcher

2eddd3b

Signed-off-by: yongjunhong <[email protected]>

YongGoose mentioned this pull request Aug 20, 2025

Invoking private method on a CGLIB proxy should trigger a dedicated exception #30938

Closed

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Aug 20, 2025

rstoyanchev requested changes Oct 1, 2025

View reviewed changes

rstoyanchev added the in: web Issues in web modules (web, webmvc, webflux, websocket) label Oct 1, 2025

sbrannen requested changes Oct 3, 2025

View reviewed changes

sbrannen added the status: waiting-for-feedback We need additional information before we can continue label Oct 3, 2025

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Oct 6, 2025

YongGoose added 3 commits October 9, 2025 13:10

Apply code review

72ff98a

Signed-off-by: yongjunhong <[email protected]>

Revert changes

549acc0

Signed-off-by: yongjunhong <[email protected]>

Create test code

6819d95

Signed-off-by: yongjunhong <[email protected]>

YongGoose requested review from rstoyanchev and sbrannen October 9, 2025 05:49

sbrannen requested changes Oct 10, 2025

View reviewed changes

sbrannen self-assigned this Oct 10, 2025

sbrannen added type: enhancement A general enhancement status: waiting-for-feedback We need additional information before we can continue and removed status: feedback-provided Feedback has been provided labels Oct 10, 2025

YongGoose and others added 8 commits October 11, 2025 09:55

Update spring-webmvc/src/main/java/org/springframework/web/servlet/mv…

e278799

…c/method/annotation/RequestMappingHandlerMapping.java Co-authored-by: Sam Brannen <[email protected]> Signed-off-by: Yongjun Hong <[email protected]>

Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…

1ff3e61

…c/method/annotation/RequestMappingHandlerMappingTests.java Co-authored-by: Sam Brannen <[email protected]> Signed-off-by: Yongjun Hong <[email protected]>

Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…

2416d27

…c/method/annotation/RequestMappingHandlerMappingTests.java Co-authored-by: Sam Brannen <[email protected]> Signed-off-by: Yongjun Hong <[email protected]>

Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…

6b884fc

…c/method/annotation/RequestMappingHandlerMappingTests.java Co-authored-by: Sam Brannen <[email protected]> Signed-off-by: Yongjun Hong <[email protected]>

Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…

c6678da

…c/method/annotation/RequestMappingHandlerMappingTests.java Co-authored-by: Sam Brannen <[email protected]> Signed-off-by: Yongjun Hong <[email protected]>

Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…

2c5f8fd

…c/method/annotation/RequestMappingHandlerMappingTests.java Co-authored-by: Sam Brannen <[email protected]> Signed-off-by: Yongjun Hong <[email protected]>

Revert unnecessary changes

6822c7c

Signed-off-by: yongjunhong <[email protected]>

Apply code review

52f981e

Signed-off-by: yongjunhong <[email protected]>

YongGoose added 2 commits October 11, 2025 21:07

Apply analogous changes to Reactive RequestMappingHandlerMapping and …

d387e78

…related tests Signed-off-by: yongjunhong <[email protected]>

Add tests

dba200f

Signed-off-by: yongjunhong <[email protected]>

YongGoose requested a review from sbrannen October 11, 2025 12:52

Remove unused annotation

a2d706c

Signed-off-by: yongjunhong <[email protected]>

		String methodPackageName = (methodPackage != null) ? methodPackage.getName() : "default package";
		String handlerPackageName = (handlerPackage != null) ? handlerPackage.getName() : "default package";

Prevent reflective invocation of private methods in web dispatcher #35352

Are you sure you want to change the base?

Prevent reflective invocation of private methods in web dispatcher #35352

Conversation

YongGoose commented Aug 20, 2025

Uh oh!

rstoyanchev left a comment • edited by sbrannen Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sbrannen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

YongGoose commented Oct 6, 2025

Uh oh!

YongGoose commented Oct 9, 2025

Uh oh!

YongGoose commented Oct 9, 2025

Uh oh!

sbrannen left a comment

Choose a reason for hiding this comment

Uh oh!

sbrannen Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

sbrannen Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

YongGoose Oct 11, 2025

Choose a reason for hiding this comment

Uh oh!

sbrannen Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

sbrannen Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rstoyanchev left a comment •

edited by sbrannen

Loading

sbrannen Oct 10, 2025 •

edited

Loading