Skip to content

v6: Disable Gson's ReflectionTypeAdapter #430

@bevzzz

Description

@bevzzz

JDK 17 made all internal classes strongly encapsulated, meaning reflection cannot be used on them.
We use this workaround --add-opens=java.base/java.lang=ALL-UNNAMED to allow Gson reflective access to all these classes, because we probably don't want to write custom TypeAdapters for each one. Since this isn't something we can "bake into" the JAR itself, we recommend users add that to their command line.

However, the encapsulation introduced in JDK 17 is a security feature and we should see if we can avoid using restrictive access. There's been many discussions about that in the Gson's repo and the consensus seems to be that using reflective de-/serialization is undesirable.

Relevant links:

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions