java通过暴力反射创建不可实例化类的对象实例

以java.lang.Math为例

Class b = Math.class; Constructor[]cc = b.getDeclaredConstructors(); Math t1=null,t2=null; for(int i =0;i<cc.length;i++) { cc[i].setAccessible(true); t1 = (Math)cc[i].newInstance(); t2 = (Math)cc[i].newInstance(); System.out.println(t1.abs(1)); System.out.println(t2.abs(1)); } System.out.println(t1 == t2);

 

要禁止此类情况，需要在jvm中加安全检查参数-Djava.security.manager