{"record":{"id":"396e39fb1ae02c32","repo":"flowable/flowable-engine","slug":"not-allowed-to-access-method-settername-on-clas-396e39","errorCode":null,"errorMessage":"Not allowed to access method ${setterName} on class ${clazz.getCanonicalName()}","messagePattern":"Not allowed to access method (.+?) on class (.+?)","errorType":"exception","errorClass":"org.activiti.engine.ActivitiException","httpStatus":null,"severity":"error","filePath":"modules/flowable5-engine/src/main/java/org/activiti/engine/impl/util/ReflectUtil.java","lineNumber":209,"sourceCode":"     */\n    public static Method getSetter(String fieldName, Class<?> clazz, Class<?> fieldType) {\n        String setterName = \"set\" + Character.toTitleCase(fieldName.charAt(0)) +\n                fieldName.substring(1);\n        try {\n            // Using getMethods(), getMethod(...) expects exact parameter type\n            // matching and ignores inheritance-tree.\n            Method[] methods = clazz.getMethods();\n            for (Method method : methods) {\n                if (method.getName().equals(setterName)) {\n                    Class<?>[] paramTypes = method.getParameterTypes();\n                    if (paramTypes != null && paramTypes.length == 1 && paramTypes[0].isAssignableFrom(fieldType)) {\n                        return method;\n                    }\n                }\n            }\n            return null;\n        } catch (SecurityException e) {\n            throw new ActivitiException(\"Not allowed to access method \" + setterName + \" on class \" + clazz.getCanonicalName(), e);\n        }\n    }\n\n    private static Method findMethod(Class<? extends Object> clazz, String methodName, Object[] args) {\n        for (Method method : clazz.getDeclaredMethods()) {\n            // TODO add parameter matching\n            if (method.getName().equals(methodName)\n                    && matches(method.getParameterTypes(), args)) {\n                return method;\n            }\n        }\n        Class<?> superClass = clazz.getSuperclass();\n        if (superClass != null) {\n            return findMethod(superClass, methodName, args);\n        }\n        return null;\n    }\n","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/util/ReflectUtil.java#L191-L227","documentation":"ReflectUtil.getSetter() scans getDeclaredMethods for a setter and wraps a SecurityException in an ActivitiException when the JVM security manager denies reflective method access. It reports the setter name and class, chained to the SecurityException.","triggerScenarios":"ReflectUtil.getSetter(clazz, setterName) while iterating clazz.getDeclaredMethods() triggers a SecurityException — the security policy forbids access to declared members of the class.","commonSituations":"Running under a restrictive SecurityManager; sandboxed app servers; accessing setters in encapsulated modules under Java 9+.","solutions":["Grant accessDeclaredMembers permission in the security policy","Remove or relax the SecurityManager in the runtime environment","Add --add-opens for the module containing the class","Verify the class/package ownership — getDeclaredMethods on foreign classes needs explicit grants"],"exampleFix":"// policy file before\n// (no grant)\n// after\ngrant {\n  permission java.lang.RuntimePermission \"accessDeclaredMembers\";\n};","handlingStrategy":"validation","validationCode":"// ensure declared methods are reachable before getSetter\ntry {\n  clazz.getDeclaredMethods();\n} catch (SecurityException e) {\n  throw new IllegalStateException(\"declared members of \" + clazz.getName() + \" are not accessible\");\n}","typeGuard":"boolean setterExists(Class<?> clazz, String setterName) {\n  for (Method m : clazz.getMethods()) {\n    if (m.getName().equals(setterName) && m.getParameterCount() == 1) return true;\n  }\n  return false;\n}","tryCatchPattern":"try {\n  Method setter = ReflectUtil.getSetter(clazz, setterName);\n} catch (ActivitiException e) {\n  logger.warn(\"setter lookup blocked: \" + e.getCause());\n  // fall back to direct field access or skip property\n}","preventionTips":["Run the engine without a restrictive SecurityManager","Use public setters so getMethods() suffices in most cases","Grant accessDeclaredMembers when introspection is needed","Keep property names consistent with bean conventions"],"tags":["reflection","security","java"],"backgroundTag":"permission-denied","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}