{"record":{"id":"0b32a39c378e3c3c","repo":"flowable/flowable-engine","slug":"not-allowed-to-access-field-field-on-class-cl-0b32a3","errorCode":null,"errorMessage":"not allowed to access field ${field} on class ${clazz.getCanonicalName()}","messagePattern":"not allowed to access field (.+?) on class (.+?)","errorType":"exception","errorClass":"org.activiti.engine.ActivitiException","httpStatus":null,"severity":"error","filePath":"modules/flowable5-engine/src/main/java/org/activiti/engine/impl/util/ReflectUtil.java","lineNumber":166,"sourceCode":"        }\n    }\n\n    /**\n     * Returns the field of the given object or null if it doesnt exist.\n     */\n    public static Field getField(String fieldName, Object object) {\n        return getField(fieldName, object.getClass());\n    }\n\n    /**\n     * Returns the field of the given class or null if it doesnt exist.\n     */\n    public static Field getField(String fieldName, Class<?> clazz) {\n        Field field = null;\n        try {\n            field = clazz.getDeclaredField(fieldName);\n        } catch (SecurityException e) {\n            throw new ActivitiException(\"not allowed to access field \" + field + \" on class \" + clazz.getCanonicalName(), e);\n        } catch (NoSuchFieldException e) {\n            // for some reason getDeclaredFields doesnt search superclasses\n            // (which getFields() does ... but that gives only public fields)\n            Class<?> superClass = clazz.getSuperclass();\n            if (superClass != null) {\n                return getField(fieldName, superClass);\n            }\n        }\n        return field;\n    }\n\n    public static void setField(Field field, Object object, Object value) {\n        try {\n            field.setAccessible(true);\n            field.set(object, value);\n        } catch (IllegalArgumentException e) {\n            throw new ActivitiException(\"Could not set field \" + field, e);\n        } catch (IllegalAccessException e) {","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/util/ReflectUtil.java#L148-L184","documentation":"ReflectUtil.getField() wraps a SecurityException from Class.getDeclaredField() in an ActivitiException stating the field is not accessible on the class. This means the JVM security policy (SecurityManager or module access rules) blocked reflective access to the declared field. Note the message may print 'null' because the field variable is still null when the exception is built.","triggerScenarios":"Calling ReflectUtil.getField(fieldName, clazz) when getDeclaredField raises SecurityException, i.e. reflective field access is denied by the security policy or class visibility rules.","commonSituations":"Running the engine under a SecurityManager with restrictive policy; accessing private fields in named modules under Java 9+ without --add-opens; container/OSGi environments restricting reflection.","solutions":["Grant reflection permission (RuntimePermission accessDeclaredMembers) in the security policy or remove the SecurityManager","Add --add-opens for the enclosing module when on Java 9+","Check the field name; note the message prints the local variable which is null on this path — confirm via the cause","If the field actually doesn't exist, fix the name or superclass lookup"],"exampleFix":"// JVM args before\njava -jar app.jar\n// after\njava --add-opens org.flowable.engine/org.flowable.engine.impl.util=ALL-UNNAMED -jar app.jar","handlingStrategy":"validation","validationCode":"// verify access before ReflectUtil.getField\ntry {\n  clazz.getDeclaredField(fieldName);\n} catch (SecurityException e) {\n  throw new IllegalStateException(\"reflection denied for \" + clazz.getName());\n}","typeGuard":"boolean fieldAccessible(Class<?> clazz, String name) {\n  try { clazz.getDeclaredField(name); return true; }\n  catch (Exception e) { return false; }\n}","tryCatchPattern":"try {\n  Field f = ReflectUtil.getField(fieldName, clazz);\n} catch (ActivitiException e) {\n  logger.warn(\"field access blocked: \" + e.getCause());\n  // fall back to getter or configuration value\n}","preventionTips":["Avoid SecurityManager in engine runtime","Use --add-opens for modular JDKs","Prefer public getters/setters over private field reflection","Confirm field names against the target class source"],"tags":["reflection","security","java"],"backgroundTag":"permission-denied","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}