From 5c6c0246ccc0e07d49ec855a939deb8b1ac42e54 Mon Sep 17 00:00:00 2001
From: Sergey Malenkov <malenkov@openjdk.org>
Date: Mon, 20 May 2013 19:49:20 +0400
Subject: [PATCH] 8012071: Better Building of Beans

Reviewed-by: art, skoivu
---
 jdk/src/share/classes/java/beans/Beans.java   |  6 ++++++
 .../beans/DefaultPersistenceDelegate.java     |  3 +++
 .../share/classes/java/beans/MetaData.java    | 19 +++++++++++--------
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/jdk/src/share/classes/java/beans/Beans.java b/jdk/src/share/classes/java/beans/Beans.java
index 2183d224167..a457fa41805 100644
--- a/jdk/src/share/classes/java/beans/Beans.java
+++ b/jdk/src/share/classes/java/beans/Beans.java
@@ -42,6 +42,8 @@ import java.io.ObjectInputStream;
 import java.io.ObjectStreamClass;
 import java.io.StreamCorruptedException;
 
+import java.lang.reflect.Modifier;
+
 import java.net.URL;
 
 import java.security.AccessController;
@@ -222,6 +224,10 @@ public class Beans {
                 throw ex;
             }
 
+            if (!Modifier.isPublic(cl.getModifiers())) {
+                throw new ClassNotFoundException("" + cl + " : no public access");
+            }
+
             /*
              * Try to instantiate the class.
              */
diff --git a/jdk/src/share/classes/java/beans/DefaultPersistenceDelegate.java b/jdk/src/share/classes/java/beans/DefaultPersistenceDelegate.java
index 3c6c7c2a3d3..6891692c30b 100644
--- a/jdk/src/share/classes/java/beans/DefaultPersistenceDelegate.java
+++ b/jdk/src/share/classes/java/beans/DefaultPersistenceDelegate.java
@@ -221,6 +221,9 @@ public class DefaultPersistenceDelegate extends PersistenceDelegate {
     // Write out the properties of this instance.
     private void initBean(Class<?> type, Object oldInstance, Object newInstance, Encoder out) {
         for (Field field : type.getFields()) {
+            if (!ReflectUtil.isPackageAccessible(field.getDeclaringClass())) {
+                continue;
+            }
             int mod = field.getModifiers();
             if (Modifier.isFinal(mod) || Modifier.isStatic(mod) || Modifier.isTransient(mod)) {
                 continue;
diff --git a/jdk/src/share/classes/java/beans/MetaData.java b/jdk/src/share/classes/java/beans/MetaData.java
index 61f51d4bb3f..d733b6f1eab 100644
--- a/jdk/src/share/classes/java/beans/MetaData.java
+++ b/jdk/src/share/classes/java/beans/MetaData.java
@@ -42,6 +42,7 @@ import java.lang.reflect.Array;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
 import java.lang.reflect.InvocationTargetException;
 
 import java.security.AccessController;
@@ -56,7 +57,7 @@ import javax.swing.plaf.ColorUIResource;
 
 import sun.swing.PrintColorUIResource;
 
-import java.util.Objects;
+import static sun.reflect.misc.ReflectUtil.isPackageAccessible;
 
 /*
  * Like the <code>Intropector</code>, the <code>MetaData</code> class
@@ -850,13 +851,15 @@ static final class java_awt_AWTKeyStroke_PersistenceDelegate extends Persistence
 
 static class StaticFieldsPersistenceDelegate extends PersistenceDelegate {
     protected void installFields(Encoder out, Class<?> cls) {
-        Field fields[] = cls.getFields();
-        for(int i = 0; i < fields.length; i++) {
-            Field field = fields[i];
-            // Don't install primitives, their identity will not be preserved
-            // by wrapping.
-            if (Object.class.isAssignableFrom(field.getType())) {
-                out.writeExpression(new Expression(field, "get", new Object[]{null}));
+        if (Modifier.isPublic(cls.getModifiers()) && isPackageAccessible(cls)) {
+            Field fields[] = cls.getFields();
+            for(int i = 0; i < fields.length; i++) {
+                Field field = fields[i];
+                // Don't install primitives, their identity will not be preserved
+                // by wrapping.
+                if (Object.class.isAssignableFrom(field.getType())) {
+                    out.writeExpression(new Expression(field, "get", new Object[]{null}));
+                }
             }
         }
     }