[HTTPCORE-664] WARNING: Illegal reflective access by org.apache.hc.core5.util.ReflectionUtils$1 (file:/mnt/blah.jar) to method sun.security.ssl.SSLEngineImpl.getApplicationProtocol()

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 5.0.3
• Component/s: HttpCore
• Environment: Java 11
• External issue URL: https://bugster.forgerock.org/jira/browse/OPENDJ-7796
• Assignee: Unassigned
• Reporter: Jean-Noel Rouvignac
• Created: 01/Feb/21 11:19
• Updated: 02/Feb/21 10:17
• Resolved: 01/Feb/21 11:26

Description

Using httpcore5 with Java 11, we noticed the code is reporting the following warning reported by the JVM:

11:50:19 WARNING: An illegal reflective access operation has occurred
11:50:19 WARNING: Illegal reflective access by org.apache.hc.core5.util.ReflectionUtils$1 (file:/mnt/blah.jar) to method sun.security.ssl.SSLEngineImpl.getApplicationProtocol()
11:50:19 WARNING: Please consider reporting this to the maintainers of org.apache.hc.core5.util.ReflectionUtils$1
11:50:19 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
11:50:19 WARNING: All illegal access operations will be denied in a future release

This illegal access should not be performed at all. I have not yet looked at the code to see how it can be avoided / removed.

 

The likely cause of this message is the following code in SSLIOSession.doHandshake():

                    if (this.tlsDetails == null) {
                        final SSLSession sslSession = this.sslEngine.getSession();
                        final String applicationProtocol = ReflectionUtils.callGetter(this.sslEngine, "ApplicationProtocol", String.class);
                        this.tlsDetails = new TlsDetails(sslSession, applicationProtocol);           
                    }