{"record":{"id":"34dbab5a988d8616","repo":"flowable/flowable-engine","slug":"not-allowed-to-access-field-field-on-class-cl","errorCode":null,"errorMessage":"not allowed to access field ${field} on class ${clazz.getCanonicalName()}","messagePattern":"not allowed to access field (.+?) on class (.+?)","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-engine-common/src/main/java/org/flowable/common/engine/impl/util/ReflectUtil.java","lineNumber":206,"sourceCode":"        }\n    }\n\n    /**\n     * Returns the field of the given object or null if it doesn't exist.\n     */\n    public static Field getField(String fieldName, Object object) {\n        return getField(fieldName, object.getClass());\n    }\n\n    /**\n     * Returns the field of the given class or null if it doesn't exist.\n     */\n    public static Field getField(String fieldName, Class<?> clazz) {\n        Field field = null;\n        try {\n            field = clazz.getDeclaredField(fieldName);\n        } catch (SecurityException e) {\n            throw new FlowableException(\"not allowed to access field \" + field + \" on class \" + clazz.getCanonicalName(), e);\n        } catch (NoSuchFieldException e) {\n            // for some reason getDeclaredFields doesn't search superclasses\n            // (which getFields() does ... but that gives only public fields)\n            Class<?> superClass = clazz.getSuperclass();\n            if (superClass != null) {\n                return getField(fieldName, superClass);\n            }\n        }\n        return field;\n    }\n\n    public static void setField(Field field, Object object, Object value) {\n        try {\n            field.setAccessible(true);\n            field.set(object, value);\n        } catch (IllegalArgumentException | IllegalAccessException e) {\n            throw new FlowableException(\"Could not set field \" + field, e);\n        }","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-engine-common/src/main/java/org/flowable/common/engine/impl/util/ReflectUtil.java#L188-L224","documentation":"ReflectUtil.getField looks up a declared field on a class (recursively checking superclasses). If the JVM SecurityManager denies access to the field (SecurityException from getDeclaredField), it throws this FlowableException; the odd message prints the still-null field variable due to where it's captured.","triggerScenarios":"Calling getField(fieldName, clazz) — directly or indirectly through invokeSetterOrField / field injection — in an environment with a SecurityManager or module restrictions that forbid reflective access to the field (e.g. private fields of JDK-internal or sealed classes).","commonSituations":"Running under a strict SecurityManager policy (common in some app servers); reflecting into java.* or module-encapsulated classes after JDK 9+; agent/sandboxed environments blocking reflection.","solutions":["Grant the code reflective permission (ReflectPermission) in your security policy file.","Avoid reflecting into JDK/module-encapsulated classes; add --add-opens flags if you own the module boundary.","Use a public accessor/getter instead of direct field access.","Run without a restrictive SecurityManager if your platform allows (note: deprecated in modern JDKs).","Restructure the target class to expose the field legitimately (package-private + same package, or setter)."],"exampleFix":"// before\n// security policy denying reflection\ngrant { };\n// after\ngrant {\n  permission java.lang.reflect.ReflectPermission \"suppressAccessChecks\";\n};","handlingStrategy":"validation","validationCode":"try {\n    clazz.getDeclaredField(fieldName);\n} catch (SecurityException e) {\n    throw new IllegalStateException(\"Security policy blocks reflective access to \" + fieldName);\n} catch (NoSuchFieldException e) {\n    throw new IllegalStateException(\"Field \" + fieldName + \" not found on \" + clazz.getName());\n}","typeGuard":null,"tryCatchPattern":"try {\n    Field f = ReflectUtil.getField(fieldName, clazz);\n} catch (FlowableException e) {\n    LOGGER.error(\"Reflective access denied for {}.{}: {}\", clazz.getName(), fieldName, e.getCause());\n    throw new SecurityConfigurationException(\"Grant ReflectPermission or avoid JDK-internal classes\", e);\n}","preventionTips":["Review security policy files when deploying to managed app servers","Avoid reflecting into java.* and module-encapsulated packages","Prefer public accessors over field reflection","Use --add-opens deliberately and document why in launch scripts"],"tags":["reflection","security","permissions","java"],"backgroundTag":"permission-denied","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}