[BEANUTILS-112] [beanutils] defaultTransformers is public in BeanMap class

• Type: Bug
• Status: Reopened
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.7.0
• Fix Version/s: 1.9.5
• Component/s: Bean-Collections

Environment

Operating System: other
Platform: Other

• Bugzilla Id: 35267
• Assignee: Niall Pemberton
• Reporter: Simon Kitching
• Created: 08/Jun/05 21:14
• Updated: 14/Apr/24 12:49

Description

The BeanMap class in the "optional" section has:
public static HashMap defaultTransformers = new HashMap();

I think this is a really bad idea.

Firstly, because it's static, various parts of an application can interact in
unexpected ways. For example, some library your code is calling might,
unexpectedly, add a transformer to the default transformers causing surprising
effects.

That's even more interesting if the library (commons-collections or
commons-beanutils) is deployed via a shared webapp in a container. In that case,
one webapp can have side-effects on other webapps.

And because it's a public member, there is no way to control access to this field.

This class was in commons-collections since 1.0. It was copied into
commons-beanutils before the 1.7.0 release, and deprecated in commons-collections.

This class is only in the "optional" section, and is not used by the core
beanutils code.

Issue Links

• is duplicated by: BEANUTILS-377 Thread-safety and code-safety issue in BeanMap