Instantiating arbitrary Java classes in XWiki pages

[THOMAS, BRIAN M (ATTSI)]

In several instances to date I have found that I can instantiate an
arbitrary Java class from a page (with programming rights) if it has a
default (i.e. no-parameters) constructor, since
java.lang.Class.newInstance() does the trick (where the Class object is
obtained by a reference to $xwiki.class).

However, to use a non-default constructor, one must use
java.lang.reflect.Constructor.newInstance(Object...).  Every attempt to
do this has failed silently.  Indeed, even calling
Class.getDeclaredConstructor(Class...) fails; the only way I've managed
to get a Constructor object is by looping through the results of
Class.getDeclaredConstructors() and picking the one that suits my needs.
No errors in logfiles, and so far I haven't even caught it in the act
while debugging it under Eclipse.

Two possibilities present themselves, though so far my investigation has
not yielded any result in either direction:

One is that I'm not passing the arguments correctly - in both cases, the
argument list is specified in the javadocs as "<typename>..." but in the
source, while the formal parameter is an array, other code actually
invokes it as a list, as in the case of a C varargs list.  Regardless, I
can't invoke it successfully either with an array or with a list.

The other is Java permissions.  Since the Constructor class is in the
java.lang.reflection package, and reflection is (I believe) a
potentially restricted operation, it may require changing the
java.security.Permission configuration.  It looks like, for Tomcat,
that's accomplished by editing the catalina.policy file.

Anyone else have experience in this area?  I know I can always create a
plugin to handle the necessary object creation, and I may eventually do
so anyway because granting the necessary permission to XWiki's libraries
may open it too widely, but for the moment, I'd rather not have to...

brain[sic]