Change a logic for controlling accessible member on OGNL #1258

Author: kazuki43zoo

src/main/java/org/apache/ibatis/reflection/Reflector.java

@@ -77,7 +77,7 @@ private void addDefaultConstructor(Class<?> clazz) {
     Constructor<?>[] consts = clazz.getDeclaredConstructors();
     for (Constructor<?> constructor : consts) {
       if (constructor.getParameterTypes().length == 0) {
-        if (canAccessPrivateMethods()) {
+        if (canControlMemberAccessible()) {
           try {
             constructor.setAccessible(true);
           } catch (Exception e) {
@@ -254,7 +254,7 @@ private Class<?> typeToClass(Type src) {
   private void addFields(Class<?> clazz) {
     Field[] fields = clazz.getDeclaredFields();
     for (Field field : fields) {
-      if (canAccessPrivateMethods()) {
+      if (canControlMemberAccessible()) {
         try {
           field.setAccessible(true);
         } catch (Exception e) {
@@ -339,7 +339,7 @@ private void addUniqueMethods(Map<String, Method> uniqueMethods, Method[] method
         // if it is known, then an extended class must have
         // overridden a method
         if (!uniqueMethods.containsKey(signature)) {
-          if (canAccessPrivateMethods()) {
+          if (canControlMemberAccessible()) {
             try {
               currentMethod.setAccessible(true);
             } catch (Exception e) {
@@ -372,7 +372,13 @@ private String getSignature(Method method) {
     return sb.toString();
   }
 
-  private static boolean canAccessPrivateMethods() {
+  /**
+   * Checks whether can control member accessible.
+   *
+   * @return If can control member accessible, it return {@literal true}
+   * @since 3.5.0
+   */
+  public static boolean canControlMemberAccessible() {
     try {
       SecurityManager securityManager = System.getSecurityManager();
       if (null != securityManager) {

src/main/java/org/apache/ibatis/scripting/xmltags/OgnlMemberAccess.java

@@ -16,10 +16,10 @@
 package org.apache.ibatis.scripting.xmltags;
 
 import ognl.MemberAccess;
+import org.apache.ibatis.reflection.Reflector;
 
 import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Member;
-import java.lang.reflect.Modifier;
 import java.util.Map;
 
 /**
@@ -35,6 +35,12 @@
  */
 class OgnlMemberAccess implements MemberAccess {
 
+  private final boolean canControlMemberAccessible;
+
+  OgnlMemberAccess() {
+    this.canControlMemberAccessible = Reflector.canControlMemberAccessible();
+  }
+
   @Override
   public Object setup(Map context, Object target, Member member, String propertyName) {
     Object result = null;
@@ -58,7 +64,7 @@ public void restore(Map context, Object target, Member member, String propertyNa
 
   @Override
   public boolean isAccessible(Map context, Object target, Member member, String propertyName) {
-    return Modifier.isPublic(member.getModifiers());
+    return canControlMemberAccessible;
   }
 
 }

src/test/java/org/apache/ibatis/submitted/member_access/CreateDB.sql

@@ -16,7 +16,6 @@
 package org.apache.ibatis.submitted.member_access;
 
 import java.io.Reader;
-import java.sql.Connection;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -26,7 +25,6 @@
 import org.apache.ibatis.annotations.Results;
 import org.apache.ibatis.annotations.Select;
 import org.apache.ibatis.io.Resources;
-import org.apache.ibatis.jdbc.ScriptRunner;
 import org.apache.ibatis.session.SqlSession;
 import org.apache.ibatis.session.SqlSessionFactory;
 import org.apache.ibatis.session.SqlSessionFactoryBuilder;
@@ -49,14 +47,6 @@ public static void setUp() throws Exception {
       sqlSessionFactory = new SqlSessionFactoryBuilder().build(reader);
       sqlSessionFactory.getConfiguration().addMapper(Mapper.class);
     }
-    try (SqlSession session = sqlSessionFactory.openSession();
-        Connection conn = session.getConnection();
-        Reader reader = Resources
-            .getResourceAsReader("org/apache/ibatis/submitted/member_access/CreateDB.sql")) {
-      ScriptRunner runner = new ScriptRunner(conn);
-      runner.setLogWriter(null);
-      runner.runScript(reader);
-    }
   }
 
   @Test
@@ -87,15 +77,15 @@ public void parameterMappingAndResultAutoMappingUsingOgnl() {
       Params params = new Params();
       Bean bean = mapper.resultAutoMappingUsingOgnl(params);
 
-      assertEquals(params.privateField, bean.privateField);
-      assertEquals(params.packagePrivateField, bean.packagePrivateField);
-      assertEquals(params.protectedField, bean.protectedField);
-      assertEquals(params.publicField, bean.publicField);
-      assertEquals(params.getPrivateProperty(), bean.properties.get("privateProperty"));
-      assertEquals(params.getPackagePrivateProperty(),
+      assertEquals(params.privateField + "%", bean.privateField);
+      assertEquals(params.packagePrivateField + "%", bean.packagePrivateField);
+      assertEquals(params.protectedField + "%", bean.protectedField);
+      assertEquals(params.publicField + "%", bean.publicField);
+      assertEquals(params.getPrivateProperty() + "%", bean.properties.get("privateProperty"));
+      assertEquals(params.getPackagePrivateProperty() + "%",
           bean.properties.get("packagePrivateProperty"));
-      assertEquals(params.getProtectedProperty(), bean.properties.get("protectedProperty"));
-      assertEquals(params.getPublicProperty(), bean.properties.get("publicProperty"));
+      assertEquals(params.getProtectedProperty() + "%", bean.properties.get("protectedProperty"));
+      assertEquals(params.getPublicProperty() + "%", bean.properties.get("publicProperty"));
     }
   }
 
@@ -217,17 +207,23 @@ interface Mapper {
         // @formatter:off
         "<script>"
 
-          ,"<bind name=\"publicFieldValue\" value=\"_parameter.publicField\" />"
-          ,"<bind name=\"publicPropertyValue\" value=\"_parameter.publicProperty\" />"
+          ,"<bind name=\"privateFieldValue\" value=\"_parameter.privateField + '%'\" />"
+          ,"<bind name=\"packagePrivateFieldValue\" value=\"_parameter.packagePrivateField + '%'\" />"
+          ,"<bind name=\"protectedFieldValue\" value=\"_parameter.protectedField + '%'\" />"
+          ,"<bind name=\"publicFieldValue\" value=\"_parameter.publicField + '%'\" />"
+          ,"<bind name=\"privatePropertyValue\" value=\"_parameter.privateProperty + '%'\" />"
+          ,"<bind name=\"packagePrivatePropertyValue\" value=\"_parameter.packagePrivateProperty + '%'\" />"
+          ,"<bind name=\"protectedPropertyValue\" value=\"_parameter.getProtectedProperty() + '%'\" />"
+          ,"<bind name=\"publicPropertyValue\" value=\"_parameter.publicProperty + '%'\" />"
 
           ,"SELECT"
-          ,"#{privateField} as privateField"
-          ,",#{packagePrivateField} as packagePrivateField"
-          ,",#{protectedField} as protectedField"
+          ,"#{privateFieldValue} as privateField"
+          ,",#{packagePrivateFieldValue} as packagePrivateField"
+          ,",#{protectedFieldValue} as protectedField"
           ,",#{publicFieldValue} as publicField"
-          ,",#{privateProperty} as privateProperty"
-          ,",#{packagePrivateProperty} as packagePrivateProperty"
-          ,",#{protectedProperty} as protectedProperty"
+          ,",#{privatePropertyValue} as privateProperty"
+          ,",#{packagePrivatePropertyValue} as packagePrivateProperty"
+          ,",#{protectedPropertyValue} as protectedProperty"
           ,",#{publicPropertyValue} as publicProperty"
 
           ,"FROM"