From 9d89cc817c2c8332a23c690140045c4f4bc4825b Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uschindler@apache.org>
Date: Wed, 11 Nov 2015 19:17:18 +0000
Subject: [PATCH] Add security check

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1713917 13f79535-47bb-0310-9956-ffa450edef68
---
 src/testcases/org/apache/poi/POITestCase.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/testcases/org/apache/poi/POITestCase.java b/src/testcases/org/apache/poi/POITestCase.java
index 8bd466c162..dda9443c81 100644
--- a/src/testcases/org/apache/poi/POITestCase.java
+++ b/src/testcases/org/apache/poi/POITestCase.java
@@ -79,6 +79,7 @@ public class POITestCase {
       * Only use this method in test cases!!!
       */
      public static <R,T> R getFieldValue(final Class<? super T> clazz, final T instance, final Class<R> fieldType, final String fieldName) {
+         assertTrue("Reflection of private fields is only allowed for POI classes.", clazz.getName().startsWith("org.apache.poi."));
          try {
             return AccessController.doPrivileged(new PrivilegedExceptionAction<R>() {
                 @Override
@@ -100,6 +101,7 @@ public class POITestCase {
       */
      public static <R,T> R callMethod(final Class<? super T> clazz, final T instance, final Class<R> returnType, final String methodName,
              final Class<?>[] parameterTypes, final Object[] parameters) {
+         assertTrue("Reflection of private methods is only allowed for POI classes.", clazz.getName().startsWith("org.apache.poi."));
          try {
             return AccessController.doPrivileged(new PrivilegedExceptionAction<R>() {
                 @Override
-- 
2.39.5