Replace ReflectionCheckingTypeAdapterFactory with a ReflectionAccessF…

…ilter (#1496) * Replace ReflectionCheckingTypeAdapterFactory with a Filter * Add test
stripe · Dec 21, 2022 · e9fcfaa · e9fcfaa
1 parent 3ce22a7
commit e9fcfaa
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 29 deletions.
diff --git a/build.gradle b/build.gradle
@@ -80,7 +80,7 @@ repositories {
 dependencies {
     errorprone group: "com.google.errorprone", name: "error_prone_core", version: "2.10.0"
     errorproneJavac group: "com.google.errorprone", name: "javac", version:"9+181-r4173-1"
-    implementation group: "com.google.code.gson", name: "gson", version:"2.9.0"
+    implementation group: "com.google.code.gson", name: "gson", version:"2.9.1"
     testImplementation group: "com.google.guava", name: "guava", version:"31.0.1-jre"
     testImplementation group: "com.squareup.okhttp3", name: "mockwebserver", version: "4.9.1"
     testImplementation group: "org.mockito", name: "mockito-core", version:"4.1.0"

diff --git a/src/main/java/com/stripe/net/ApiResource.java b/src/main/java/com/stripe/net/ApiResource.java
@@ -3,6 +3,7 @@
 import com.google.gson.FieldNamingPolicy;
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
+import com.google.gson.ReflectionAccessFilter;
 import com.google.gson.TypeAdapterFactory;
 import com.stripe.Stripe;
 import com.stripe.exception.InvalidRequestException;
@@ -36,7 +37,17 @@ private static Gson createGson() {
             .registerTypeAdapter(Event.Data.class, new EventDataDeserializer())
             .registerTypeAdapter(Event.Request.class, new EventRequestDeserializer())
             .registerTypeAdapter(ExpandableField.class, new ExpandableFieldDeserializer())
-            .registerTypeAdapter(StripeRawJsonObject.class, new StripeRawJsonObjectDeserializer());
+            .registerTypeAdapter(StripeRawJsonObject.class, new StripeRawJsonObjectDeserializer())
+            .addReflectionAccessFilter(
+                new ReflectionAccessFilter() {
+                  @Override
+                  public ReflectionAccessFilter.FilterResult check(Class<?> rawClass) {
+                    if (rawClass.getTypeName().startsWith("com.stripe.")) {
+                      return ReflectionAccessFilter.FilterResult.ALLOW;
+                    }
+                    return ReflectionAccessFilter.FilterResult.BLOCK_ALL;
+                  }
+                });
 
     for (TypeAdapterFactory factory : ApiResourceTypeAdapterFactoryProvider.getAll()) {
       builder.registerTypeAdapterFactory(factory);

diff --git a/src/main/java/com/stripe/net/ApiResourceTypeAdapterFactoryProvider.java b/src/main/java/com/stripe/net/ApiResourceTypeAdapterFactoryProvider.java
@@ -18,7 +18,6 @@ final class ApiResourceTypeAdapterFactoryProvider {
     factories.add(new BalanceTransactionSourceTypeAdapterFactory());
     factories.add(new ExternalAccountTypeAdapterFactory());
     factories.add(new PaymentSourceTypeAdapterFactory());
-    factories.add(new ReflectionCheckingTypeAdapterFactory());
   }
 
   public static List<TypeAdapterFactory> getAll() {

diff --git a/src/main/java/com/stripe/net/ReflectionCheckingTypeAdapterFactory.java b/src/main/java/com/stripe/net/ReflectionCheckingTypeAdapterFactory.java
diff --git a/src/test/java/com/stripe/net/ApiResourceTest.java b/src/test/java/com/stripe/net/ApiResourceTest.java
@@ -2,8 +2,11 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import com.google.gson.JsonIOException;
 import com.stripe.exception.InvalidRequestException;
+import java.net.Proxy;
 import org.junit.jupiter.api.Test;
 
 class ApiResourceTest {
@@ -23,4 +26,17 @@ public void testUrlEncodeIdThrowingOnNull() {
           ApiResource.urlEncodeId(null);
         });
   }
+
+  static class MyClass extends ApiResource {
+    public Proxy proxy;
+  }
+
+  @Test
+  public void testReflectionFilter() {
+    JsonIOException e =
+        assertThrows(JsonIOException.class, () -> ApiResource.GSON.fromJson("{}", MyClass.class));
+
+    // Assert that the error message involves a ReflectionAccessFilter.
+    assertTrue(e.getMessage().contains("ReflectionAccessFilter"));
+  }
 }