{"record":{"id":"80e3e8618ae82549","repo":"apache/cassandra","slug":"access-forbidden","errorCode":null,"errorMessage":"Access forbidden","messagePattern":"Access forbidden","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/io/compress/DefaultCompressionProvider.java","lineNumber":80,"sourceCode":"    public ICompressor createCompressor(Class<?> compressorClass, Map<String, String> compressionOptions) throws IllegalStateException\n    {\n        try\n        {\n            Method method = compressorClass.getMethod(\"create\", Map.class);\n            ICompressor compressor = (ICompressor)method.invoke(null, compressionOptions);\n            // Check for unknown options\n            for (String provided : compressionOptions.keySet())\n                if (!compressor.supportedOptions().contains(provided))\n                    throw new ConfigurationException(\"Unknown compression options \" + provided);\n            return compressor;\n        }\n        catch (NoSuchMethodException e)\n        {\n            throw new ConfigurationException(\"create method not found\", e);\n        }\n        catch (SecurityException e)\n        {\n            throw new ConfigurationException(\"Access forbidden\", e);\n        }\n        catch (IllegalAccessException e)\n        {\n            throw new ConfigurationException(\"Cannot access method create in \" + compressorClass.getName(), e);\n        }\n        catch (InvocationTargetException e)\n        {\n            if (e.getTargetException() instanceof ConfigurationException)\n                throw (ConfigurationException) e.getTargetException();\n\n            Throwable cause = e.getCause() == null\n                            ? e\n                            : e.getCause();\n\n            throw new ConfigurationException(format(\"%s.create() threw an error: %s %s\",\n                                                    compressorClass.getSimpleName(),\n                                                    cause.getClass().getName(),\n                                                    cause.getMessage()),","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/io/compress/DefaultCompressionProvider.java#L62-L98","documentation":"The reflective lookup or invocation of the compressor's create(Map) method raised a SecurityException, meaning a SecurityManager (or similar access control) forbade the reflective access. The provider converts this into the 'Access forbidden' ConfigurationException to surface the access-control failure during configuration.","triggerScenarios":"createCompressor() invoked under a Java SecurityManager or restrictive policy that denies reflective access (ReflectPermission) or access to the compressor class/package — typically a custom compressor in a package not opened to the caller.","commonSituations":"Hardened production JVMs running with a security policy; Java 9+ module systems where the compressor package is not opened/exported; containers with custom java.security policies; third-party compressor classes loaded from restricted classloaders.","solutions":["Grant the necessary ReflectPermission / access in the JVM security policy, or disable the SecurityManager if it is not required.","For Java 9+ modules, add --add-opens for the package containing the compressor class.","Move the custom compressor into an accessible package or make its create method public in an exported module.","Use the built-in compressors, which are always accessible to DefaultCompressionProvider."],"exampleFix":"// before\njava ... -Djava.security.manager -Djava.security.policy=strict.policy\n// after\njava ... --add-opens org.example.compress/org.example.compress=ALL-UNNAMED -Djava.security.policy=strict.policy","handlingStrategy":"validation","validationCode":"try {\n    Method m = compressorClass.getMethod(\"create\", Map.class);\n    m.trySetAccessible(); // or m.setAccessible(true)\n    m.invoke(null, Collections.emptyMap());\n} catch (SecurityException | IllegalAccessException e) {\n    throw new IllegalStateException(\"Reflective access to \" + compressorClass + \".create denied by security policy\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    registry.getCompressor(cls, opts);\n} catch (ConfigurationException e) {\n    if (e.getMessage().equals(\"Access forbidden\")) log.error(\"SecurityManager/JPMS denies reflective create on {}\", cls);\n    throw e;\n}","preventionTips":["Avoid running Cassandra with a restrictive SecurityManager unless required","Add --add-opens for packages holding custom compressors on Java 9+","Keep custom compressor classes public in exported packages","Test compressor creation under the production security policy, not just a bare JVM"],"tags":["compression","security","reflection"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}