An illegal reflective access operation has occurred
patpatpat123 opened this issue · 9 comments
Hello Team,
Thank you for this very cool project.
I wanted to report an issue here if you allow me please:
On a very simple maven + SpringBoot project, I am always getting this:
[INFO] --- dependency-check-maven:7.0.1:aggregate (default) @ myproject ---
[INFO] Checking for updates
[INFO] Download Started for NVD CVE - Modified
[INFO] Download Complete for NVD CVE - Modified (2508 ms)
[INFO] Processing Started for NVD CVE - Modified
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.fasterxml.jackson.module.afterburner.util.MyClassLoader (file:/Users/me/.m2/repository/com/fasterxml/jackson/module/jackson-module-afterburner/2.13.2/jackson-module-afterburner-2.13.2.jar) to method java.lang.ClassLoader.findLoadedClass(java.lang.String)
WARNING: Please consider reporting this to the maintainers of com.fasterxml.jackson.module.afterburner.util.MyClassLoader
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
I understand there are ways to "hie" the issue.
But I was wondering, if you can help fix this issue please?
Thank you
@patpatpat123 This output unfortunately does not explain WHICH class is problematic, or how to reproduce it. So we cannot really help with it without more information.
So a reproduction would be needed.
Understood, let me put together an example
Failing to reproduce. Will open an issue again with the sample if I mange to reproduce.
Thank you
As I just closed, I managed to reproduce:
A reproducible example can be found at: https://github.com/patpatpat123/springvaultcve
After running the command, this is always reproducible: mvn clean install dependency:tree -X
[INFO] --- dependency-check-maven:7.0.4:aggregate (default) @ vaxholm ---
[INFO] Checking for updates
[INFO] Download Started for NVD CVE - Modified
[INFO] Download Complete for NVD CVE - Modified (6101 ms)
[INFO] Processing Started for NVD CVE - Modified
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.fasterxml.jackson.module.afterburner.util.MyClassLoader (file:/Users/me/.m2/repository/com/fasterxml/jackson/module/jackson-module-afterburner/2.13.2/jackson-module-afterburner-2.13.2.jar) to method java.lang.ClassLoader.findLoadedClass(java.lang.String)
WARNING: Please consider reporting this to the maintainers of com.fasterxml.jackson.module.afterburner.util.MyClassLoader
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Cold you please kindly help?
This output unfortunately does not explain WHICH class is problematic, or how to reproduce it. So we cannot really help with it without more information.
The error message points to ClassLoader.findLoadedClass, which Afterburner forcibly accesses here:
I believe all of these setAccessible calls into base Java classes cause this warning, and will cease to work in newer JVMs.
I am not sure why the dependency-check-maven plugin uses Afterburner, but unless the speed of reading JSON is really the limiting factor, the easiest fix might be for the dependency-check-maven plugin to drop its usage of Afterburner.
@patpatpat123 , what version of the JDK do you run this with?
It looks like the Maven plugin attempts to select Afterburner vs Blackbird based on JDK version:
jeremylong/DependencyCheck#4971
So, it is possible everything is ok here.
I am using JDK 11, managed to reproduce with JDK 17 as well.
Ok, there is nothing we can do here I think: this forced access is required by Afterburner and either user has to open access on later JDKs, or not use Afterburner (use of Blackbird is recommended).
So this warning is not something I know how to avoid.
I don't have strong opinion on if and how other projects should use Afterburner -- it probably wouldn't make much sense usually for Maven plug-in, but it looks like DependencyCheck is (or can be?) standalone tool and performance improvements are measurable.
Closing.