4.3.2.final patch

.gitignore

@@ -39,6 +39,10 @@ maven-eclipse.xml
 # NetBeans specific files/directories
 .nbattrs
 
+# Sublime Text
+*.sublime-project
+*.sublime-workspace
+
 # Miscellaneous
 *.log
 .clover

engine/src/main/java/org/hibernate/validator/internal/cfg/context/ConfiguredConstraint.java

@@ -49,13 +49,13 @@ private ConfiguredConstraint(ConstraintDef<?, A> constraint, L location) {
 		this.location = location;
 	}
 
-	public static <A extends Annotation> ConfiguredConstraint<A, BeanConstraintLocation> forType(ConstraintDef<?, A> constraint, Class<?> beanType) {
+	static <A extends Annotation> ConfiguredConstraint<A, BeanConstraintLocation> forType(ConstraintDef<?, A> constraint, Class<?> beanType) {
 		return new ConfiguredConstraint<A, BeanConstraintLocation>(
 				constraint, new BeanConstraintLocation( beanType )
 		);
 	}
 
-	public static <A extends Annotation> ConfiguredConstraint<A, BeanConstraintLocation> forProperty(ConstraintDef<?, A> constraint, Member member) {
+	static <A extends Annotation> ConfiguredConstraint<A, BeanConstraintLocation> forProperty(ConstraintDef<?, A> constraint, Member member) {
 
 		return new ConfiguredConstraint<A, BeanConstraintLocation>(
 				constraint, new BeanConstraintLocation( member )

engine/src/main/java/org/hibernate/validator/internal/cfg/context/ConstraintMappingContextImplBase.java

@@ -19,6 +19,8 @@
 import java.lang.annotation.ElementType;
 import java.lang.reflect.Member;
 import java.lang.reflect.Method;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 
 import org.hibernate.validator.cfg.context.MethodConstraintMappingContext;
 import org.hibernate.validator.cfg.context.PropertyConstraintMappingContext;
@@ -27,6 +29,9 @@
 import org.hibernate.validator.internal.util.ReflectionHelper;
 import org.hibernate.validator.internal.util.logging.Log;
 import org.hibernate.validator.internal.util.logging.LoggerFactory;
+import org.hibernate.validator.internal.util.privilegedactions.GetDeclaredField;
+import org.hibernate.validator.internal.util.privilegedactions.GetDeclaredMethod;
+import org.hibernate.validator.internal.util.privilegedactions.GetMethod;
 
 import static org.hibernate.validator.internal.util.logging.Messages.MESSAGES;
 
@@ -35,7 +40,7 @@
  *
  * @author Gunnar Morling
  */
-public abstract class ConstraintMappingContextImplBase {
+abstract class ConstraintMappingContextImplBase {
 
 	private static final Log log = LoggerFactory.make();
 
@@ -58,9 +63,7 @@ public PropertyConstraintMappingContext property(String property, ElementType el
 		Contracts.assertNotNull( elementType, "The element type must not be null." );
 		Contracts.assertNotEmpty( property, MESSAGES.propertyNameMustNotBeEmpty() );
 
-		Member member = ReflectionHelper.getMember(
-				beanClass, property, elementType
-		);
+		Member member = getMember( beanClass, property, elementType );
 
 		if ( member == null ) {
 			throw log.getUnableToFindPropertyWithAccessException( beanClass, property, elementType );
@@ -72,7 +75,7 @@ public PropertyConstraintMappingContext property(String property, ElementType el
 	public MethodConstraintMappingContext method(String name, Class<?>... parameterTypes) {
 		Contracts.assertNotNull( name, MESSAGES.methodNameMustNotBeNull() );
 
-		Method method = ReflectionHelper.getDeclaredMethod( beanClass, name, parameterTypes );
+		Method method = run( GetDeclaredMethod.action( beanClass, name, parameterTypes ) );
 
 		if ( method == null ) {
 			StringBuilder sb = new StringBuilder();
@@ -87,4 +90,63 @@ public MethodConstraintMappingContext method(String name, Class<?>... parameterT
 
 		return new MethodConstraintMappingContextImpl( beanClass, method, mapping );
 	}
+
+	/**
+	 * Returns the member with the given name and type.
+	 *
+	 * @param clazz The class from which to retrieve the member. Cannot be {@code null}.
+	 * @param property The property name without 'is', 'get' or 'has'. Cannot be {@code null} or empty.
+	 * @param elementType The element type. Either {@code ElementType.FIELD} or {@code ElementType METHOD}.
+	 *
+	 * @return the member which matching the name and type or {@code null} if no such member exists.
+	 */
+	private Member getMember(Class<?> clazz, String property, ElementType elementType) {
+
+		Contracts.assertNotNull( clazz, MESSAGES.classCannotBeNull() );
+
+		if ( property == null || property.length() == 0 ) {
+			throw log.getPropertyNameCannotBeNullOrEmptyException();
+		}
+
+		if ( !( ElementType.FIELD.equals( elementType ) || ElementType.METHOD.equals( elementType ) ) ) {
+			throw log.getElementTypeHasToBeFieldOrMethodException();
+		}
+
+		Member member = null;
+		if ( ElementType.FIELD.equals( elementType ) ) {
+			GetDeclaredField action = GetDeclaredField.action( clazz, property );
+			if ( System.getSecurityManager() != null ) {
+				member = AccessController.doPrivileged( action );
+			}
+			else {
+				member = action.run();
+			}
+		}
+		else {
+			String methodName = property.substring( 0, 1 ).toUpperCase() + property.substring( 1 );
+			for ( String prefix : ReflectionHelper.PROPERTY_ACCESSOR_PREFIXES ) {
+				GetMethod action = GetMethod.action( clazz, prefix + methodName );
+				if ( System.getSecurityManager() != null ) {
+					member = AccessController.doPrivileged( action );
+				}
+				else {
+					member = action.run();
+				}
+				if ( member != null ) {
+					break;
+				}
+			}
+		}
+		return member;
+	}
+
+	/**
+	 * Runs the given privileged action, using a privileged block if required.
+	 * <p>
+	 * <b>NOTE:</b> This must never be changed into a publicly available method to avoid execution of arbitrary
+	 * privileged actions within HV's protection domain.
+	 */
+	private static <T> T run(PrivilegedAction<T> action) {
+		return System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run();
+	}
 }

engine/src/main/java/org/hibernate/validator/internal/cfg/context/MethodConstraintMappingContextImpl.java

@@ -29,13 +29,13 @@
  * @author Kevin Pollet <[email protected]> (C) 2011 SERLI
  * @author Gunnar Morling
  */
-public class MethodConstraintMappingContextImpl implements MethodConstraintMappingContext {
+class MethodConstraintMappingContextImpl implements MethodConstraintMappingContext {
 
 	private final Class<?> beanClass;
 	private final Method method;
 	private final ConstraintMappingContext mapping;
 
-	public MethodConstraintMappingContextImpl(Class<?> beanClass, Method method, ConstraintMappingContext mapping) {
+	MethodConstraintMappingContextImpl(Class<?> beanClass, Method method, ConstraintMappingContext mapping) {
 
 		this.beanClass = beanClass;
 		this.method = method;

engine/src/main/java/org/hibernate/validator/internal/cfg/context/ParameterConstraintMappingContextImpl.java

@@ -32,7 +32,7 @@
  * @author Gunnar Morling
  * @author Kevin Pollet <[email protected]> (C) 2011 SERLI
  */
-public final class ParameterConstraintMappingContextImpl
+final class ParameterConstraintMappingContextImpl
 		extends ConstraintMappingContextImplBase
 		implements ParameterConstraintMappingContext {
 

engine/src/main/java/org/hibernate/validator/internal/cfg/context/PropertyConstraintMappingContextImpl.java

@@ -37,7 +37,7 @@ public final class PropertyConstraintMappingContextImpl extends ConstraintMappin
 
 	private final Member member;
 
-	public PropertyConstraintMappingContextImpl(Class<?> beanClass, Member member, ConstraintMappingContext mapping) {
+	PropertyConstraintMappingContextImpl(Class<?> beanClass, Member member, ConstraintMappingContext mapping) {
 		super( beanClass, mapping );
 
 		this.member = member;

engine/src/main/java/org/hibernate/validator/internal/cfg/context/ReturnValueConstraintMappingContextImpl.java

@@ -30,13 +30,13 @@
  * @author Gunnar Morling
  * @author Kevin Pollet <[email protected]> (C) 2011 SERLI
  */
-public final class ReturnValueConstraintMappingContextImpl
+final class ReturnValueConstraintMappingContextImpl
 		extends ConstraintMappingContextImplBase
 		implements ReturnValueConstraintMappingContext {
 
 	private final Method method;
 
-	public ReturnValueConstraintMappingContextImpl(Class<?> beanClass, Method method, ConstraintMappingContext mapping) {
+	ReturnValueConstraintMappingContextImpl(Class<?> beanClass, Method method, ConstraintMappingContext mapping) {
 
 		super( beanClass, mapping );
 

engine/src/main/java/org/hibernate/validator/internal/engine/ConstraintValidatorFactoryImpl.java

@@ -16,20 +16,34 @@
 */
 package org.hibernate.validator.internal.engine;
 
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
 import javax.validation.ConstraintValidator;
 import javax.validation.ConstraintValidatorFactory;
 
-import org.hibernate.validator.internal.util.ReflectionHelper;
+import org.hibernate.validator.internal.util.privilegedactions.NewInstance;
 
 /**
  * Default <code>ConstraintValidatorFactory</code> using a no-arg constructor.
  *
  * @author Emmanuel Bernard
  * @author Hardy Ferentschik
  */
+//TODO Can we make the constructor non-public?
 public class ConstraintValidatorFactoryImpl implements ConstraintValidatorFactory {
 
 	public final <T extends ConstraintValidator<?, ?>> T getInstance(Class<T> key) {
-		return ReflectionHelper.newInstance( key, "ConstraintValidator" );
+		return run( NewInstance.action( key, "ConstraintValidator" ) );
+	}
+
+	/**
+	 * Runs the given privileged action, using a privileged block if required.
+	 * <p>
+	 * <b>NOTE:</b> This must never be changed into a publicly available method to avoid execution of arbitrary
+	 * privileged actions within HV's protection domain.
+	 */
+	private <T> T run(PrivilegedAction<T> action) {
+		return System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run();
 	}
 }