{"id":"117a942421a79352","repo":"spring-projects/spring-framework","slug":"is-the-constructor-accessible","errorCode":null,"errorMessage":"Is the constructor accessible?","messagePattern":"Is the constructor accessible\\?","errorType":"exception","errorClass":"BeanInstantiationException","httpStatus":null,"severity":"error","filePath":"spring-beans/src/main/java/org/springframework/beans/BeanUtils.java","lineNumber":111,"sourceCode":"\t * @return the new instance\n\t * @throws BeanInstantiationException if the bean cannot be instantiated\n\t * @see Class#newInstance()\n\t * @deprecated following the deprecation of {@link Class#newInstance()} in JDK 9\n\t */\n\t@Deprecated(since = \"5.0\")\n\tpublic static <T> T instantiate(Class<T> clazz) throws BeanInstantiationException {\n\t\tAssert.notNull(clazz, \"Class must not be null\");\n\t\tif (clazz.isInterface()) {\n\t\t\tthrow new BeanInstantiationException(clazz, \"Specified class is an interface\");\n\t\t}\n\t\ttry {\n\t\t\treturn clazz.newInstance();\n\t\t}\n\t\tcatch (InstantiationException ex) {\n\t\t\tthrow new BeanInstantiationException(clazz, \"Is it an abstract class?\", ex);\n\t\t}\n\t\tcatch (IllegalAccessException ex) {\n\t\t\tthrow new BeanInstantiationException(clazz, \"Is the constructor accessible?\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Instantiate a class using its 'primary' constructor (for Kotlin classes,\n\t * potentially having default arguments declared) or its default constructor\n\t * (for regular Java classes, expecting a standard no-arg setup).\n\t * <p>Note that this method tries to set the constructor accessible\n\t * if given a non-accessible (that is, non-public) constructor.\n\t * @param clazz the class to instantiate\n\t * @return the new instance\n\t * @throws BeanInstantiationException if the bean cannot be instantiated.\n\t * The cause may notably indicate a {@link NoSuchMethodException} if no\n\t * primary/default constructor was found, a {@link NoClassDefFoundError}\n\t * or other {@link LinkageError} in case of an unresolvable class definition\n\t * (for example, due to a missing dependency at runtime), or an exception thrown\n\t * from the constructor invocation itself.\n\t * @see Constructor#newInstance","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/spring-projects/spring-framework/blob/e8729d043887bf0d0baf91e062e909b56eb2b708/spring-beans/src/main/java/org/springframework/beans/BeanUtils.java#L93-L129","documentation":"Thrown as BeanInstantiationException by the deprecated BeanUtils.instantiate(Class) when Class.newInstance() raises IllegalAccessException, meaning the no-arg constructor exists but is not accessible from the caller (non-public and not exported/opened). The deprecated path does not call makeAccessible, unlike instantiateClass.","triggerScenarios":"BeanUtils.instantiate(Foo.class) where Foo has a package-private or protected no-arg constructor and the call originates from a different package/module, via BeanUtils.java:110-112.","commonSituations":"Third-party class with a non-public default constructor; JPMS module that does not open the package to Spring; calling instantiate() from a different package than the target.","solutions":["Migrate to BeanUtils.instantiateClass(clazz) which calls ReflectionUtils.makeAccessible and bypasses the access check.","Make the no-arg constructor public on the target class if you own it.","For modules, add 'opens <package> to spring.core;' or '--add-opens' so reflective access is permitted.","Obtain the constructor yourself, call setAccessible(true), and use Constructor.newInstance / instantiateClass(ctor)."],"exampleFix":"// before\nBeanUtils.instantiate(HiddenCtor.class); // package-private ctor -> IllegalAccessException\n\n// after\nBeanUtils.instantiateClass(HiddenCtor.class); // makeAccessible is applied","handlingStrategy":"validation","validationCode":"Constructor<?> c = clazz.getDeclaredConstructor();\nif (!Modifier.isPublic(c.getModifiers())) {\n  // use instantiateClass(Class) which applies makeAccessible, instead of deprecated instantiate()\n}","typeGuard":"public static boolean hasAccessibleNoArgCtor(Class<?> c) {\n  try { return Modifier.isPublic(c.getDeclaredConstructor().getModifiers()); }\n  catch (NoSuchMethodException e) { return false; }\n}","tryCatchPattern":"try { BeanUtils.instantiate(clazz); }\ncatch (BeanInstantiationException e) {\n  if (e.getCause() instanceof IllegalAccessException) { BeanUtils.instantiateClass(clazz); }\n}","preventionTips":["Migrate to BeanUtils.instantiateClass(Class) which calls makeAccessible.","Make no-arg constructors public if you own the class.","Configure JPMS 'opens' directives for cross-module reflective access."],"tags":["spring-beans","beanutils","instantiation","accessibility","deprecated"],"analyzedSha":"e8729d043887bf0d0baf91e062e909b56eb2b708","analyzedAt":"2026-08-04T19:07:39.725Z","schemaVersion":2}