只允许从某些包构建对象

Question

I work on a game-like system. Users can submit .class and .java files for customized behaviour. Some objects are delivered to the user via callback, but if the user can construct these object himself (with custom parameters), it would mean an advantage to him. I will disallow reflection for the user and seal my packages. I can get this working if I abandon all package structure (and make the constructors package-private), but I would like not to do so.

---

Here is an example:

sscce.mycode.a.SomeClass.java :

package sscce.mycode.a;

import sscce.mycode.b.RestrictedObject;
import sscce.usercode.SomeUserClass;

public class SomeClass {

    public static void main(String[] args) {
        SomeUserClass userClass=new SomeUserClass();

        // If I can create it from here, anyone can...
        RestrictedObject object=new RestrictedObject();

        userClass.someMethod(object);
    }

}

sscce.mycode.b.Interface.java :

package sscce.mycode.b;

public interface Interface {

    public void someMethod(RestrictedObject restrictedObject);

}

sscce.mycode.b.RestrictedObject.java :

package sscce.mycode.b;

public class RestrictedObject {

    public RestrictedObject() {}

}

sscce.usercode.SomeUserClass.java :

package sscce.usercode;

import sscce.mycode.b.Interface;
import sscce.mycode.b.RestrictedObject;

public class SomeUserClass implements Interface {

    @Override
    public void someMethod(RestrictedObject restrictedObject) {
        // It receives an instance, but cannot create it.
        System.out.println("Got "+restrictedObject);
    }
}

---

Motivation : Having everything in one package sounds messy...

Does anyone have ideas on how to accomplish this without flattening the packages?
Thanks in advance for any solutions, ideas or comments, Till

Answer 1

You could do it the following way, however you should carefully consider if you really want to use this approach as it is very slow and quite frankly, bad practice. I'll put it up anyway as to how you can do it:

public final class Secured {

  private static final Set<Class<?>> allowedCallers = new HashSet<>();

  static {
    allowedCallers.add(Allowed.class);
  }

  private static final class SecurityManagerExtension extends SecurityManager {

    private static final int OFFSET = 4;

    @Override
    protected Class<?>[] getClassContext() {
      return super.getClassContext();
    }

    private Class<?> getCaller() {
      try {
        return getClassContext()[OFFSET];
      } catch (ArrayIndexOutOfBoundsException e) {
        return null;
      }
    }
  }

  private Secured() {
    // protect against reflection attack
    Class<?> caller = new SecurityManagerExtension().getCaller();
    if (!this.getClass().equals(caller)) {
      throw new IllegalStateException();
    }
    System.out.println("Secured instance constructed!");
  }

  public static Secured createInstance() {
    // this gets the class name of the calling class
    Class<?> caller = new SecurityManagerExtension().getCaller();
    if (allowedCallers.contains(caller)) {
      System.out.println("Created instance by '" + caller + "'!");
      return new Secured();
    } else {
      System.out.println("No instance created because call was made by '" + caller + "'!");
      return null;
    }
  }
}

Note the final keyword on the class to prevent subclassing. If you need to subclass the class yourself, move the final keyword to the factory method. Also note that this is not protected against serialization attacks.