Is java code using java.lang.reflect.get*
methods vulnerable to privilege escalation, if yes then how? Also is the below code vulnerable to privilege escalation attack?
A a = new A();
Field[] field = b.getClass().getDeclaredFields();
for(Field f : field) {
f.setAccessible(true);
Object fval = f.get(b)
if(fval!=null){
a.set(f.getName(), fval);
}
}