Comment by josefx

3 months ago

Java reflection can load classes without initializing them, so no untrusted code would have to be executed at that point.

3 comments

josefx

Reply
hinkley  3 months ago

I haven’t been in Java for a good while. When did they do that?

Static initializers used to load on Classloader calls.

  • josefx  3 months ago

    An overload for Class.forName with an explicit initialize parameter was added in Java 1.2 .

    • hinkley  3 months ago

      Except they don't call Class.forName(..., false, ...) anywhere in the codebase, so my original comment still stands.