私人方法真的安全吗?

在 Java 中,private访问修饰符被认为是安全的,因为它在类之外是不可见的。那外面的世界也不知道这个方法。

但是我认为 Java 反射可以用来打破这个规则:

public class ProtectedPrivacy{


private String getInfo(){
return "confidential";
}


}

现在,我将从另一节课中获得信息:

public class BreakPrivacy{


public static void main(String[] args) throws Exception {
ProtectedPrivacy protectedPrivacy = new ProtectedPrivacy();
Method method = protectedPrivacy.getClass().getDeclaredMethod("getInfo", null);
method.setAccessible(true);
Object result = method.invoke(protectedPrivacy);
System.out.println(result.toString());
}
}

此刻我只是想仍然私有方法安全,因为做一些像上面这样的事情,我们必须知道方法名。但是,如果类包含由其他人编写的私有方法,我们就不能看到这些方法。

但我的观点是无效的,因为下面的代码行。

Method method[] = new ProtectedPrivacy().getClass().getDeclaredMethods();

现在这个 method[]包含了上面所有需要做的事情。我的问题是,有没有办法避免使用 Java 反射做这种事情?

我从 Java 文档引用一些观点来澄清我的问题。

选择访问级别的提示:

如果其他程序员使用您的类,则需要确保错误 访问级别可以帮助你做到这一点。使用 最严格的访问级别,对于特定的 除非有充分的理由,否则请使用 private。

6034 次浏览

It depends on what you mean by "safe". If you're running with a security manager that allows this sort of thing, then yes, you can do all kinds of nasty things with reflection. But then in that kind of environment the library can probably just be modified to make the method public anyway.

Access control is effectively "advisory" in an environment like that - you're effectively trusting the code to play nicely. If you don't trust the code you're running, you should use a more restrictive security manager.

By saying 'safe', you are protecting you or other developers, which are using your API to not harm the object by calling your private method. But if you or they really need to call this method, they can do it with Reflection.

With facility, there comes responsibility. There are thing's you can't do, & things you can do but you shouldn't do.

Private modifier is provided/used as/in the most restricted manner. Members which should not be visible outside the class shall be defined as private. But this can be broken with Reflection as we see. But this does not mean that you should not use private - or they are unsafe. It is about you shall use things judiciously or in constructive manner (like reflection).

Assuming you trust the client programmer of your API, another way of looking at is how 'safe' it is for them to use those particular functions.

Your publicly available functions should provide a clear, well-documented, rarely-changing interface into your code. Your private functions can be considered an implementation detail and may change over time, so are not safe to use directly.

If a client programmer goes out of their way to circumvent these abstractions, they are in a way declaring that they know what they are doing. More importantly, they understand that it is unsupported and may stop working with future versions of your code.

The question is who are you trying to save it from. In my opinion, such a client of your code is the one at a loss here.

Any piece of code (written by you or others) which tries to access a private member of the above class is essentially digging its own grave. private members don't make a part of the public API and are subject to change without notice. If a client happens to consume one of such private members in the manner given above, it's going to break if it upgrades to a newer version of the API in which the private member got modified.

Access modifiers have nothing to do with security. In fact you can and should look at access modifiers as the reverse of security -- it is not to protect your data or algorithims, it is to protect people from the requirement to know about your data and algorithims. This is why the default modifier is package -- if they are working on the package they probably already need to know.

Along with the knowledge of the data and the methods of your code, comes the responibility to know when and how to use it. You don't put private on your inIt method to keep someone from finding out about it, you do so because (a) they aren't going to know that you only call that after foo and only if bar = 3.1415 and (b) because it does them no good to know about it.

Access modifers can be summed up in a simple phrase "TMI, dude, I so didn't need to know that".

private is not for security, it is to keep the code clean and to prevent mistakes. It allows users to modularize the code (and how it is developed) without having to worry about all the details of the other modules

Once you release your code, people can figure out how it works. There's no way to "hide" the logic if you eventually want the code to run on a computer. Even compiling to binary is jsut a level of obfuscation.

So, there's no way that you can set up your API to do special things that you don't want others to be able to call. In the case of a web API, you could put the methods you want control over on the server side.