6 Mar
2007
6 Mar
'07
6:57 p.m.
In several instances to date I have found that I can instantiate an
arbitrary Java class from a page (with programming rights) if it has a
default (i.e. no-parameters) constructor, since
java.lang.Class.newInstance() does the trick (where the Class object is
obtained by a reference to $xwiki.class).
However, to use a non-default constructor, one must use
java.lang.reflect.Constructor.newInstance(Object...). Every attempt to
do this has failed silently. Indeed, even calling
Class.getDeclaredConstructor(Class...) fails; the only way I've managed
to get a Constructor object is by looping through the results of
Class.getDeclaredConstructors() and picking the one that suits my needs.
No errors in logfiles, and so far I haven't even caught it in the act
while debugging it under Eclipse.
Two possibilities present themselves, though so far my investigation has
not yielded any result in either direction:
One is that I'm not passing the arguments correctly - in both cases, the
argument list is specified in the javadocs as "<typename>..." but in the
source, while the formal parameter is an array, other code actually
invokes it as a list, as in the case of a C varargs list. Regardless, I
can't invoke it successfully either with an array or with a list.
The other is Java permissions. Since the Constructor class is in the
java.lang.reflection package, and reflection is (I believe) a
potentially restricted operation, it may require changing the
java.security.Permission configuration. It looks like, for Tomcat,
that's accomplished by editing the catalina.policy file.
Anyone else have experience in this area? I know I can always create a
plugin to handle the necessary object creation, and I may eventually do
so anyway because granting the necessary permission to XWiki's libraries
may open it too widely, but for the moment, I'd rather not have to...
brain[sic]