Changing a field’s type in recent JDKs

A couple of years ago, I attended a talk of my former colleague (but still friend) Volker Simonis. It gave me the idea to dig a bit into the subject of how to secure the JVM. From the material, I created a series of blog posts as well as a talk.

From that point on, I submitted the talk at meetups and conferences, where it was well-received. Because I like to explore different areas, I stopped to submit other proposals. Still, the talk is in my portfolio, and it was requested again in 2021. I have already presented it twice since the beginning of the year at the time of this writing.

It allowed me to update the demo with version 16 of the JDK. In this blog post, I want to share some findings regarding the security changes regarding changing a field’s type across JDK versions.

Fun with JDK 8

Let’s start with the JDK. Here’s a quiz I show early in my talk:

Take some time to guess the result of executing this program when running it with a JDK 8.

Here’s the relevant class diagram to help you:

As can be seen, Field has a type attribute that contains…​ its type. With the above code, one can change the type of hidden from int to String so that the above code executes and prints "This should print 5!".

With JDK 16, the snippet doesn’t work anymore. It throws a runtime exception instead:

The exception explicitly mentions line 12: Field.class.getDeclaredField("type"). It seems as if the implementation of the Field class changed.

Looking at the source code of JDK 16

Let’s look at the source code in JDK 16:

  1. Interestingly, the field type is there.

If the field is present, why do we get the exception? We need to dive a bit into the code to understand the reason.

Here’s the sequence diagram of Class.getDeclaredField():

The diagram reveals two interesting bits:

  1. The Reflection class manages a cache to improve performance.
  2. A field named fieldFilterMap filters out the fields that reflective access return.

Let’s investigate the Reflection class to understand the runtime doesn’t find the type attribute:

Since version 9, the JDK offers a new API to access fields as part of the java.lang.invoke package.

Here’s a quite simplified class diagram focusing on our usage:

  1. All of the Field attributes are filtered out!

For this reason, none of the attributes of Field are accessible via reflection!

An alternative way to change the type

Since version 9, the JDK offers a new API to access fields as part of the java.lang.invoke package.

Here’s a quite simplified class diagram focusing on our usage:

One can use the API to access the type attribute as above. The code looks like the following:

But running the code yields the following:

But running the code yields the following:

Though the code compiles and runs, it throws at field.set(foo, "This should print 5!"). We reference the type field and can change it without any issue, but it still complains.

The reason lies in the last line of the getDeclaredField() method:

  1. Return a copy of the Field object, not the Field itself.

Since the JDK code returns a copy of the field, the change happens on this copy, and we cannot change the original field’s type.

Conclusion

Though Java touts itself as a statically-typed language, version 8 of the JVM allows us to change the type at runtime dynamically. One of my favorite jokes during the talk mentioned above is that though we have learned that Java is statically-typed, it is dynamically-typed in reality.

We can track the change precisely in Java 12: the version 11 of the Reflection class shows a basic fieldFilterMap; the version 12 shows a fully-configured one. Hence, if you want to avoid nasty surprises, you should upgrade to the latter, if not the latest.

To go further:

Originally published at A Java Geek on April 4th, 2021.

Dev Advocate @Hazelcast . Former developer and architect. Still teaching, learning and blogging.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store