Package org.apache.juneau.marshall.objecttools

Class ObjectIntrospector

java.lang.Object

org.apache.juneau.marshall.objecttools.ObjectIntrospector

public class ObjectIntrospector
extends Object

POJO method introspector.

This class is used to invoke methods on Objects using arguments in serialized form.

Security - secure by default:

As of Juneau 10.0, reflective method dispatch is denied by default. Before calling invokeMethod(...) (in any of its overloaded forms), the caller must explicitly allow-list the method(s) that may be invoked via allow(...) or allow(Predicate). Invoking a method that isn't allow-listed throws MethodNotAllowlistedException.

For trusted, in-process callers that need the pre-10.0 behavior of dispatching to any public, non-deprecated method, call allowAll() as a one-line migration. Never call allowAll() on an introspector whose method name/arguments are derived from an untrusted source (e.g. a REST request parameter) — allow-list the specific methods instead.

Example:

String string1 = "foobar"; String string2 = ObjectIntrospector .create(string1) .allow(String.class, "substring(int,int)") // Explicit allow-list. .invokeMethod(String.class, "substring(int,int)", "[3,6]"); // "bar"

For trusted, in-process-only use, allowAll() can be used instead of an explicit allow-list:

String string2 = ObjectIntrospector .create(string1) .allowAll() .invokeMethod(String.class, "substring(int,int)", "[3,6]"); // "bar"

The arguments passed to the identified method are POJOs serialized in JSON format. Arbitrarily complex arguments can be passed in as arguments.

• This is an extremely powerful but potentially dangerous tool. Use wisely.

Constructor Summary

Constructors

Constructor	Description
ObjectIntrospector(Object o)	Shortcut for calling new ObjectIntrospector(o, null);
ObjectIntrospector(Object object, ReaderParser parser)	Constructor.

Method Summary

Modifier and Type	Method	Description
ObjectIntrospector	allow(Class<?> declaringClass, String... signatures)	Allow-lists specific method signatures declared on (or inherited by) the specified class.
ObjectIntrospector	allow(Predicate<Method> filter)	Allow-lists methods matching the specified filter for invocation via invokeMethod(java.lang.Class<T>, java.lang.reflect.Method, java.io.Reader).
ObjectIntrospector	allowAll()	Disables allow-list enforcement, restoring the pre-10.0 behavior of allowing any public, non-deprecated method to be invoked.
static ObjectIntrospector	create(Object o)	Static creator.
static ObjectIntrospector	create(Object o, ReaderParser parser)	Static creator.
<T> T	invokeMethod(Class<T> returnType, Method method, Reader args)	Primary method.
<T> T	invokeMethod(Class<T> returnType, String method, String args)	Convenience method for invoking argument from method signature (@see MethodInfo.getSignature().
Object	invokeMethod(Method method, Reader args)	Primary method.
Object	invokeMethod(String method, String args)	Convenience method for invoking argument from method signature (@see MethodInfo.getSignature().

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ObjectIntrospector

public ObjectIntrospector(Object o)

Shortcut for calling new ObjectIntrospector(o, null);

Parameters:

o - The object on which Java methods will be invoked.

ObjectIntrospector

public ObjectIntrospector(Object object,
 ReaderParser parser)

Constructor.

Parameters:

object - The object on which Java methods will be invoked. Can be null (subsequent method invocations return null).

parser - The parser to use to parse the method arguments. If null, Json5Parser.DEFAULT is used.

Method Details

create

public static ObjectIntrospector create(Object o)

Static creator.

Parameters:

o - The object on which Java methods will be invoked.

Returns:

A new ObjectIntrospector object.

create

public static ObjectIntrospector create(Object o,
 ReaderParser parser)

Static creator.

Parameters:

o - The object on which Java methods will be invoked.

parser - The parser to use to parse the method arguments. If null, Json5Parser.DEFAULT is used.

Returns:

A new ObjectIntrospector object.

allow

public ObjectIntrospector allow(Predicate<Method> filter)

Allow-lists methods matching the specified filter for invocation via invokeMethod(java.lang.Class<T>, java.lang.reflect.Method, java.io.Reader).

Can be called multiple times; the filters are OR'ed together, so a method is allowed if it matches any filter that was added.

Parameters:

filter - Filter that returns true for methods that may be invoked.

Returns:

This object.

allow

public ObjectIntrospector allow(Class<?> declaringClass,
 String... signatures)

Allow-lists specific method signatures declared on (or inherited by) the specified class.

Example:

ObjectIntrospector.create(myBean).allow(MyBean.class, "getName", "getAge");

Parameters:

declaringClass - The class the allow-listed methods must be declared on (or a subtype thereof).

signatures - One or more method signatures as returned by MethodInfo.getSignature() (e.g. "getName", "substring(int,int)").

Returns:

This object.

allowAll

public ObjectIntrospector allowAll()

Disables allow-list enforcement, restoring the pre-10.0 behavior of allowing any public, non-deprecated method to be invoked.

Use only for trusted, in-process callers. Never call this method on an introspector whose method name and/or arguments are sourced from an untrusted caller (e.g. parsed from an HTTP request) — allow-list the specific methods instead via allow(...).

Returns:

This object.

invokeMethod

public <T> T invokeMethod(Class<T> returnType,
 Method method,
 Reader args)
                   throws InvocationTargetException,
IllegalArgumentException,
IllegalAccessException,
ParseException,
IOException

Primary method.

Invokes the specified method on this bean.

Type Parameters:

T - The return type of the method call.

Parameters:

returnType - The return type of the method call.

method - The method being invoked.

args - The arguments to pass as parameters to the method. These will automatically be converted to the appropriate object type if possible. Can be null if method has no arguments.

Returns:

The object returned by the call to the method, or null if target object is null.

Throws:

IllegalAccessException - If the Constructor object enforces Java language access control and the underlying constructor is inaccessible.

IllegalArgumentException - If one of the following occurs:

• The number of actual and formal parameters differ.
• An unwrapping conversion for primitive arguments fails.
• A parameter value cannot be converted to the corresponding formal parameter type by a method invocation conversion.
• The constructor pertains to an enum type.

InvocationTargetException - If the underlying constructor throws an exception.

ParseException - Malformed input encountered.

IOException - Thrown by underlying stream.

MethodNotAllowlistedException - If the method has not been allow-listed via allow(...) or allowAll().

invokeMethod

public <T> T invokeMethod(Class<T> returnType,
 String method,
 String args)
                   throws NoSuchMethodException,
IllegalArgumentException,
InvocationTargetException,
IllegalAccessException,
ParseException,
IOException

Convenience method for invoking argument from method signature (@see MethodInfo.getSignature().

Type Parameters:

T - The return type of the method call.

Parameters:

returnType - The return type of the method call.

method - The method being invoked.

args - The arguments to pass as parameters to the method. These will automatically be converted to the appropriate object type if possible. Can be null if method has no arguments.

Returns:

The object returned by the call to the method, or null if target object is null.

Throws:

NoSuchMethodException - If method does not exist.

IllegalAccessException - If the Constructor object enforces Java language access control and the underlying constructor is inaccessible.

IllegalArgumentException - If one of the following occurs:

• The number of actual and formal parameters differ.
• An unwrapping conversion for primitive arguments fails.
• A parameter value cannot be converted to the corresponding formal parameter type by a method invocation conversion.
• The constructor pertains to an enum type.

InvocationTargetException - If the underlying constructor throws an exception.

ParseException - Malformed input encountered.

IOException - Thrown by underlying stream.

MethodNotAllowlistedException - If the method has not been allow-listed via allow(...) or allowAll().

invokeMethod

public Object invokeMethod(Method method,
 Reader args)
                    throws InvocationTargetException,
IllegalArgumentException,
IllegalAccessException,
ParseException,
IOException

Primary method.

Invokes the specified method on this bean.

The method must have been allow-listed via allow(...) (or allow(Predicate)) or allowAll() prior to calling this method, otherwise a MethodNotAllowlistedException is thrown. See the class-level javadoc for details.

Parameters:

method - The method being invoked.

args - The arguments to pass as parameters to the method. These will automatically be converted to the appropriate object type if possible. Can be null if method has no arguments.

Returns:

The object returned by the call to the method, or null if target object is null.

Throws:

IllegalAccessException - If the Constructor object enforces Java language access control and the underlying constructor is inaccessible.

IllegalArgumentException - If one of the following occurs:

• The number of actual and formal parameters differ.
• An unwrapping conversion for primitive arguments fails.
• A parameter value cannot be converted to the corresponding formal parameter type by a method invocation conversion.
• The constructor pertains to an enum type.

InvocationTargetException - If the underlying constructor throws an exception.

ParseException - Malformed input encountered.

IOException - Thrown by underlying stream.

MethodNotAllowlistedException - If the method has not been allow-listed via allow(...) or allowAll().

invokeMethod

public Object invokeMethod(String method,
 String args)
                    throws NoSuchMethodException,
IllegalArgumentException,
InvocationTargetException,
IllegalAccessException,
ParseException,
IOException

Convenience method for invoking argument from method signature (@see MethodInfo.getSignature().

Parameters:

method - The method being invoked.

args - The arguments to pass as parameters to the method. These will automatically be converted to the appropriate object type if possible. Can be null if method has no arguments.

Returns:

The object returned by the call to the method, or null if target object is null.

Throws:

NoSuchMethodException - If method does not exist.

IllegalAccessException - If the Constructor object enforces Java language access control and the underlying constructor is inaccessible.

IllegalArgumentException - If one of the following occurs:

• The number of actual and formal parameters differ.
• An unwrapping conversion for primitive arguments fails.
• A parameter value cannot be converted to the corresponding formal parameter type by a method invocation conversion.
• The constructor pertains to an enum type.

InvocationTargetException - If the underlying constructor throws an exception.

ParseException - Malformed input encountered.

IOException - Thrown by underlying stream.

MethodNotAllowlistedException - If the method has not been allow-listed via allow(...) or allowAll().