Databases
StackOverflow2013
Postsdbo
POAre private methods really safe?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POAre private methods really safe?
    primarykey
    data
    text
    <p>In Java the <code>private</code> access modifier consider as safe since it is not visible outside of the class. Then outside world doesn't know about that method either. </p> <p>But I thought Java reflection can use to break this rule. Consider following case:</p> <pre class="lang-java prettyprint-override"><code>public class ProtectedPrivacy{ private String getInfo(){ return "confidential"; } } </code></pre> <p>Now from another class I am going to get Info:</p> <pre class="lang-java prettyprint-override"><code>public class BreakPrivacy{ public static void main(String[] args) throws Exception { ProtectedPrivacy protectedPrivacy = new ProtectedPrivacy(); Method method = protectedPrivacy.getClass().getDeclaredMethod("getInfo", null); method.setAccessible(true); Object result = method.invoke(protectedPrivacy); System.out.println(result.toString()); } } </code></pre> <p>At this moment I just thought still private method safe since to do some thing like above we must know method name. But if class which contain private method written by some one else we don't have visibility of those.</p> <p>But my point become invalid since below line of code.</p> <pre class="lang-java prettyprint-override"><code>Method method[] = new ProtectedPrivacy().getClass().getDeclaredMethods(); </code></pre> <p>Now this <code>method[]</code> contains all the things need to do above thing. My question is, is there a way to avoid this kind of things doing using Java reflection?</p> <p>I am quote some point from <a href="http://docs.oracle.com/javase/tutorial/java/javaOO/accesscontrol.html" rel="nofollow">Java Documentation</a> to clarify my question.</p> <blockquote> <p>Tips on Choosing an Access Level: </p> <p>If other programmers use your class, you want to ensure that errors from misuse cannot happen. Access levels can help you do this.Use the most restrictive access level that makes sense for a particular member. Use private unless you have a good reason not to.</p> </blockquote>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USRoman C
    1. USRuchira Gayan Ranaweera
    plurals
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POAre private methods really safe?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POAre private methods really safe?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POAre private methods really safe?
      1. This table or related slice is empty.
      1. VTUpMod
    1. COUsing an obfuscator may help, because `getDeclaredMethods` would return names that look like garbage.
      singulars
      1. POAre private methods really safe?
      1. USdasblinkenlight
    2. COPrivate, protected public etc is not for security, it is to avoid well meaning people from making mistakes. Do not use it as a security measure
      singulars
      1. POAre private methods really safe?
      1. USRichard Tingle
    3. COJava code is decompilable anyway. An 'attacker' could just download a Java decompiler and read your code, or change 'private' to 'public'.
      singulars
      1. POAre private methods really safe?
      1. US11684
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload