2

I am wondering, which portions of reflection are allowed to be used within EJBs (EJB3.x), which ones are discouraged to be used and which ones are forbidden.

[EDIT] I am generally speaking about stuff like getMethod(), method.invoke() etc on the different EJB Types, so no java POJO stuff.

I searched the EJB core specification without finding real hints on that.

I personally believe, that avoiding the use of reflection outside frameworks is good programming style, but the question remains, which portions are allowed by standard?

Thanks in advance!

gorefest
  • 849
  • 8
  • 22
  • This question is not specific. Under what context within EJB? Cause third party libraries used within ejb session beans may use reflections. But performing a reflective call on ejb session beans itself wouldnt be a good idea of course, cause how ejb container provides a reference to a bean is implementation dependent, some using proxy, some inheriting from your own session bean – maress Mar 27 '15 at 12:42
  • thanks for the hint, I specified my question a little more. I mean using reflection on EJB types. – gorefest Mar 27 '15 at 13:04

1 Answers1

3

Have you seen what spec EJB 3.1 says in point 21.2.2 ?

The enterprise bean must not attempt to query a class to obtain information about the declared members that are not otherwise accessible to the enterprise bean because of the security rules of the Java language. The enterprise bean must not attempt to use the Reflection API to access information that the security rules of the Java programming language make unavailable.

So generally speaking - you should not violate language defined security rules.

slwk
  • 587
  • 3
  • 7
  • I found that one. I once learned, that using reflection in general is forbidden on EJBs, but that is not covered. This implies that a method.invoke() on an EJB proxy would be OK as long as the method is public, right? – gorefest Mar 27 '15 at 13:05