google/gson · error · JsonIOException

Unable to create instance of ${rawType}; ReflectionAccessFil

Error message

Unable to create instance of ${rawType}; ReflectionAccessFilter does not permit using reflection or Unsafe. Register an InstanceCreator or a TypeAdapter for this type or adjust the access filter to allow using reflection.

What it means

Thrown when a ReflectionAccessFilter blocks all reflection and Unsafe for the type (filterResult is BLOCK_ALL or BLOCK_INACCESSIBLE, i.e. not ALLOW), the type has no accessible no-args constructor, and no InstanceCreator is registered. The filter deliberately prevents reflective instantiation. The message suggests adjusting the filter or registering an InstanceCreator/TypeAdapter.

Source

Thrown at gson/src/main/java/com/google/gson/internal/ConstructorConstructor.java:424

   * ObjectConstructor}, which would then choose another way of creating the object. And it supports
   * types which are only serialized but not deserialized (compared to directly throwing an
   * exception when the {@code ObjectConstructor} is requested), e.g. when the runtime type of an
   * object is inaccessible, but the compile-time type is accessible.
   */
  private static final class ThrowingObjectConstructor<T> implements ObjectConstructor<T> {
    private final String exceptionMessage;

    ThrowingObjectConstructor(String exceptionMessage) {
      this.exceptionMessage = exceptionMessage;
    }

    @Override
    public T construct() {
      // New exception is created every time to avoid keeping a reference to an exception with
      // potentially long stack trace, causing a memory leak
      // (which would happen if the exception was already created when the
      // `ThrowingObjectConstructor` is created)
      throw new JsonIOException(exceptionMessage);
    }
  }

  private static final class InstanceCreatorConstructor<T> implements ObjectConstructor<T> {
    private final InstanceCreator<T> instanceCreator;
    private final Type type;

    InstanceCreatorConstructor(InstanceCreator<T> instanceCreator, Type type) {
      this.instanceCreator = instanceCreator;
      this.type = type;
    }

    @Override
    public T construct() {
      return instanceCreator.createInstance(type);
    }
  }
}

View on GitHub (pinned to 310ac341f2)

Solutions

Register an InstanceCreator for the type to control construction without reflection
Register a custom TypeAdapter for the type
Adjust the ReflectionAccessFilter to ALLOW the specific type if appropriate (create a filter that returns ALLOW for your model package)
Add an accessible no-args constructor and ensure the filter permits it

Example fix

// before
gsonBuilder.addReflectionAccessFilter(c -> FilterResult.BLOCK_ALL);
// MyType has no InstanceCreator, no accessible no-args ctor

// after
gsonBuilder.registerTypeAdapter(MyType.class,
  (InstanceCreator<MyType>) type -> new MyType(defaultValue));

Defensive patterns

Strategy: validation

Validate before calling

// Before using a ReflectionAccessFilter, ensure InstanceCreators exist for blocked types
Class<?> c = MyType.class;
FilterResult result = myFilter.check(c);
if (result != FilterResult.ALLOW) {
  boolean hasNoArgs;
  try { c.getDeclaredConstructor(); hasNoArgs = ReflectionAccessFilterHelper.canAccess(c.getDeclaredConstructor(), null); }
  catch (NoSuchMethodException e) { hasNoArgs = false; }
  if (!hasNoArgs && !hasInstanceCreator(c)) {
    throw new IllegalStateException(c + " will fail with filter " + result + "; register InstanceCreator");
  }
}

Try / catch

try {
  return gson.fromJson(json, MyType.class);
} catch (JsonIOException e) {
  if (e.getMessage().contains("ReflectionAccessFilter does not permit")) {
    // register InstanceCreator and retry, or widen the filter
    throw new MyParseException("ReflectionAccessFilter blocked " + MyType.class, e);
  }
  throw e;
}

Prevention

Register an InstanceCreator for every type a ReflectionAccessFilter blocks that lacks an accessible no-args constructor
Design filters to return ALLOW for your own model package and block only platform/unknown classes
Test deserialization paths with the same filter configuration used in production

When it happens

Trigger: A configured ReflectionAccessFilter returns BLOCK_ALL or BLOCK_INACCESSIBLE for the type; the type lacks an accessible no-args constructor; no InstanceCreator or TypeAdapter is registered; no default-implementation constructor applies.

Common situations: Security-hardened applications using GsonBuilder.addReflectionAccessFilter; JPMS module isolation where packages aren't open; blocking reflection on platform/internal classes with BLOCK_ALL_JAVA or BLOCK_ALL_PLATFORM.

Related errors

AI-assisted analysis of google/gson@310ac341f2 (2026-08-10). Data as JSON: /api/errors/d3ad28065599de96. Report an issue: GitHub.