{"record":{"id":"d3ad28065599de96","repo":"google/gson","slug":"unable-to-create-instance-of-rawtype-reflectio","errorCode":null,"errorMessage":"Unable to create instance of ${rawType}; ReflectionAccessFilter does not permit using reflection or Unsafe. Register an InstanceCreator or a TypeAdapter for this type or adjust the access filter to allow using reflection.","messagePattern":"Unable to create instance of (.+?); ReflectionAccessFilter does not permit using reflection or Unsafe\\. Register an InstanceCreator or a TypeAdapter for this type or adjust the access filter to allow using reflection\\.","errorType":"exception","errorClass":"JsonIOException","httpStatus":null,"severity":"error","filePath":"gson/src/main/java/com/google/gson/internal/ConstructorConstructor.java","lineNumber":424,"sourceCode":"   * ObjectConstructor}, which would then choose another way of creating the object. And it supports\n   * types which are only serialized but not deserialized (compared to directly throwing an\n   * exception when the {@code ObjectConstructor} is requested), e.g. when the runtime type of an\n   * object is inaccessible, but the compile-time type is accessible.\n   */\n  private static final class ThrowingObjectConstructor<T> implements ObjectConstructor<T> {\n    private final String exceptionMessage;\n\n    ThrowingObjectConstructor(String exceptionMessage) {\n      this.exceptionMessage = exceptionMessage;\n    }\n\n    @Override\n    public T construct() {\n      // New exception is created every time to avoid keeping a reference to an exception with\n      // potentially long stack trace, causing a memory leak\n      // (which would happen if the exception was already created when the\n      // `ThrowingObjectConstructor` is created)\n      throw new JsonIOException(exceptionMessage);\n    }\n  }\n\n  private static final class InstanceCreatorConstructor<T> implements ObjectConstructor<T> {\n    private final InstanceCreator<T> instanceCreator;\n    private final Type type;\n\n    InstanceCreatorConstructor(InstanceCreator<T> instanceCreator, Type type) {\n      this.instanceCreator = instanceCreator;\n      this.type = type;\n    }\n\n    @Override\n    public T construct() {\n      return instanceCreator.createInstance(type);\n    }\n  }\n}","sourceCodeStart":406,"sourceCodeEnd":442,"githubUrl":"https://github.com/google/gson/blob/310ac341f2f92a454b229bf21f70d2d18b2b6db7/gson/src/main/java/com/google/gson/internal/ConstructorConstructor.java#L406-L442","documentation":"Thrown when a ReflectionAccessFilter blocks all reflection and Unsafe for the type (filterResult is BLOCK_ALL or BLOCK_INACCESSIBLE, i.e. not ALLOW), the type has no accessible no-args constructor, and no InstanceCreator is registered. The filter deliberately prevents reflective instantiation. The message suggests adjusting the filter or registering an InstanceCreator/TypeAdapter.","triggerScenarios":"A configured ReflectionAccessFilter returns BLOCK_ALL or BLOCK_INACCESSIBLE for the type; the type lacks an accessible no-args constructor; no InstanceCreator or TypeAdapter is registered; no default-implementation constructor applies.","commonSituations":"Security-hardened applications using GsonBuilder.addReflectionAccessFilter; JPMS module isolation where packages aren't open; blocking reflection on platform/internal classes with BLOCK_ALL_JAVA or BLOCK_ALL_PLATFORM.","solutions":["Register an InstanceCreator for the type to control construction without reflection","Register a custom TypeAdapter for the type","Adjust the ReflectionAccessFilter to ALLOW the specific type if appropriate (create a filter that returns ALLOW for your model package)","Add an accessible no-args constructor and ensure the filter permits it"],"exampleFix":"// before\ngsonBuilder.addReflectionAccessFilter(c -> FilterResult.BLOCK_ALL);\n// MyType has no InstanceCreator, no accessible no-args ctor\n\n// after\ngsonBuilder.registerTypeAdapter(MyType.class,\n  (InstanceCreator<MyType>) type -> new MyType(defaultValue));","handlingStrategy":"validation","validationCode":"// Before using a ReflectionAccessFilter, ensure InstanceCreators exist for blocked types\nClass<?> c = MyType.class;\nFilterResult result = myFilter.check(c);\nif (result != FilterResult.ALLOW) {\n  boolean hasNoArgs;\n  try { c.getDeclaredConstructor(); hasNoArgs = ReflectionAccessFilterHelper.canAccess(c.getDeclaredConstructor(), null); }\n  catch (NoSuchMethodException e) { hasNoArgs = false; }\n  if (!hasNoArgs && !hasInstanceCreator(c)) {\n    throw new IllegalStateException(c + \" will fail with filter \" + result + \"; register InstanceCreator\");\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  return gson.fromJson(json, MyType.class);\n} catch (JsonIOException e) {\n  if (e.getMessage().contains(\"ReflectionAccessFilter does not permit\")) {\n    // register InstanceCreator and retry, or widen the filter\n    throw new MyParseException(\"ReflectionAccessFilter blocked \" + MyType.class, e);\n  }\n  throw e;\n}","preventionTips":["Register an InstanceCreator for every type a ReflectionAccessFilter blocks that lacks an accessible no-args constructor","Design filters to return ALLOW for your own model package and block only platform/unknown classes","Test deserialization paths with the same filter configuration used in production"],"tags":["reflection-filter","security","instance-creator","reflection","jpms"],"backgroundTag":null,"analyzedSha":"310ac341f2f92a454b229bf21f70d2d18b2b6db7","analyzedAt":"2026-08-10T02:58:47.455Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}