From: Uwe Schindler <uschindler@apache.org>
Date: Wed, 11 Nov 2015 19:17:18 +0000 (+0000)
Subject: Add security check
X-Git-Tag: REL_3_14_BETA1~125
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=9d89cc817c2c8332a23c690140045c4f4bc4825b;p=poi.git

Add security check

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1713917 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/src/testcases/org/apache/poi/POITestCase.java b/src/testcases/org/apache/poi/POITestCase.java
index 8bd466c162..dda9443c81 100644
--- a/src/testcases/org/apache/poi/POITestCase.java
+++ b/src/testcases/org/apache/poi/POITestCase.java
@@ -79,6 +79,7 @@ public class POITestCase {
       * Only use this method in test cases!!!
       */
      public static <R,T> R getFieldValue(final Class<? super T> clazz, final T instance, final Class<R> fieldType, final String fieldName) {
+         assertTrue("Reflection of private fields is only allowed for POI classes.", clazz.getName().startsWith("org.apache.poi."));
          try {
             return AccessController.doPrivileged(new PrivilegedExceptionAction<R>() {
                 @Override
@@ -100,6 +101,7 @@ public class POITestCase {
       */
      public static <R,T> R callMethod(final Class<? super T> clazz, final T instance, final Class<R> returnType, final String methodName,
              final Class<?>[] parameterTypes, final Object[] parameters) {
+         assertTrue("Reflection of private methods is only allowed for POI classes.", clazz.getName().startsWith("org.apache.poi."));
          try {
             return AccessController.doPrivileged(new PrivilegedExceptionAction<R>() {
                 @Override