farkhalit commented on PR #432:
URL: https://github.com/apache/commons-cli/pull/432#issuecomment-5042258631
Fair question. It is not a security boundary on its own: if someone can
already control argv and put a class on your classpath, they have other
options. What it changes is *ordering*, and that is what an application can
actually use.
The sane way to consume a `Class`-typed option is parse first, validate,
then use:
```java
Class<?> c = cl.getParsedOptionValue("c");
if (!Plugin.class.isAssignableFrom(c)) {
throw new ParseException("not a plugin: " + c.getName());
}
Plugin p = (Plugin) c.getConstructor().newInstance();
```
On master that check is dead code from a protection standpoint. The static
initializer of whatever name appeared in argv has already run inside
`getParsedOptionValue`, before the application ever sees the `Class` object. So
an application doing everything right still cannot gate anything: the code ran
during parsing. With `initialize` false, the app receives a resolved `Class`
with nothing from it executed, and initialization happens only if and when the
app decides to instantiate or touch a static. The validation point goes back to
the caller, where it belongs.
Secondary, more mundane benefit: eager initialization means a class whose
static init is heavy or throws surfaces as `ExceptionInInitializerError` /
`NoClassDefFoundError` out of the parser instead of something the application
can handle, and you pay that cost even for classes the app then rejects.
Reflection APIs generally split resolve from initialize for exactly this
reason; `Class.forName(String)` is just the convenience overload that folds
them together.
`Converter.OBJECT` keeps the current behavior since `newInstance()`
initializes anyway, so nothing regresses there.
If you would rather keep the current semantics, happy to close it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
