In several instances to date I have found that I can instantiate an arbitrary Java class from a page (with programming rights) if it has a default (i.e. no-parameters) constructor, since java.lang.Class.newInstance() does the trick (where the Class object is obtained by a reference to $xwiki.class). However, to use a non-default constructor, one must use java.lang.reflect.Constructor.newInstance(Object...). Every attempt to do this has failed silently. Indeed, even calling Class.getDeclaredConstructor(Class...) fails; the only way I've managed to get a Constructor object is by looping through the results of Class.getDeclaredConstructors() and picking the one that suits my needs. No errors in logfiles, and so far I haven't even caught it in the act while debugging it under Eclipse. Two possibilities present themselves, though so far my investigation has not yielded any result in either direction: One is that I'm not passing the arguments correctly - in both cases, the argument list is specified in the javadocs as "<typename>..." but in the source, while the formal parameter is an array, other code actually invokes it as a list, as in the case of a C varargs list. Regardless, I can't invoke it successfully either with an array or with a list. The other is Java permissions. Since the Constructor class is in the java.lang.reflection package, and reflection is (I believe) a potentially restricted operation, it may require changing the java.security.Permission configuration. It looks like, for Tomcat, that's accomplished by editing the catalina.policy file. Anyone else have experience in this area? I know I can always create a plugin to handle the necessary object creation, and I may eventually do so anyway because granting the necessary permission to XWiki's libraries may open it too widely, but for the moment, I'd rather not have to... brain[sic]