The Java Reflection API allows programs to dynamically obtain class information and operate fields, methods, and constructors at runtime, and supports creating instances, calling methods and accessing private members; 2. The three ways to obtain Class objects are: class name.class, object.getClass(), and Class.forName("fullly qualified name"), and the third type needs to handle ClassNotFoundException; 3. You can get fields through getDeclaredField() and getField(), setAccessible(true) breaks through access restrictions and cooperates with get() and set() operation values; 4. Use getDeclaredMethod() to get methods (including private), and call them through invoke(), and support parameter type matching; 5. Use getConstructor() or getDeclaredConstructor() to get the constructor, and then create the object in newInstance(). The private constructor must first setAccessible(true); 6. It is widely used in frameworks such as Spring dependency injection, Jackson serialization, JUnit testing, Hibernate ORM, etc. to achieve automated object operations; 7. The reflection performance is low, and due to limited security checks and JIT optimization, it is recommended to cache reflected objects and avoid high-frequency calls; 8. There are security risks, such as destroying encapsulation and deserialization vulnerabilities, and should be restricted to use in a controlled environment to avoid openness to untrusted inputs; 9. To obtain generic information, you must use the getGenericXxx() method, such as getGenericReturnType() Or getGenericType(), return the ParameterizedType type; 10. Best practices include: prioritizing getDeclaredXxx(), carefully calling setAccessible(true), cache reflective objects, properly handling exceptions, and avoiding abuse of reflection to replace normal design patterns. Only by correctly understanding and rational use of reflections can we avoid performance and safety risks while improving flexibility.

The Java Reflection API is a powerful mechanism provided by Java, allowing programs to check, access and modify structural information such as classes, methods, fields, constructors at runtime, and even call methods or operate fields at runtime without knowing their existence at compile time. This "introduction" ability is widely used in framework development, dependency injection, serialization, testing tools and other scenarios.

This article will give you a comprehensive understanding of the core capabilities, usage, best practices, and potential risks of the Java Reflection API.

1. What is Java Reflection?

Reflection refers to the ability of a program to dynamically obtain class information and operate classes or objects at runtime. Under normal circumstances, Java code is compiled and executed through the JVM. While using reflection, you can run:

• Get the class name, modifier, parent class, and implementation interface
• Get the fields, methods, and constructor of the class
• Create an object instance
• Calling methods
• Access and modify field values (including private fields)

This breaks the encapsulation, but also brings great flexibility.

 Class<?> clazz = String.class; // Get Class object Object obj = clazz.newInstance(); // Create an instance (outdated, it is recommended to use Constructor)

2. Three ways to get Class objects

Before using reflection, you must first get Class object. There are three common ways:

• Calling .class by class name

   Class<String> clazz = String.class;

• Calling .getClass() via object

   String str = "hello";
  Class<? extends String> clazz = str.getClass();

• Use Class.forName() via the fully qualified name of the class

   Class<?> clazz = Class.forName("java.lang.String");

?? Note: Class.forName() may throw ClassNotFoundException and needs to be processed.

3. Use reflection operation class members

Get Field (Field)

You can get the fields of the class (including public, private, etc.) and read or modify its values.

 Field field = clazz.getDeclaredField("value"); // Get private field field.setAccessible(true); // Break through access restrictions String value = (String) field.get(obj); // Get field value field.set(obj, "new value"); // Set field value

• getDeclaredField() : Get the fields declared by this class (excluding inheritance)
• getField() : Only public fields (including inherited)

Get method (Method)

Methods that call objects, including private methods.

 Method method = clazz.getDeclaredMethod("toString");
method.setAccessible(true);
String result = (String) method.invoke(obj); // Call method

Support parameter and return value type matching:

 Method method = clazz.getDeclaredMethod("substring", int.class, int.class);
String result = (String) method.invoke(str, 0, 3);

Get the constructor

Dynamically create object instances.

 Constructor<?> cons = clazz.getConstructor(String.class);
Object obj = cons.newInstance("hello");

Supports getting private constructors and instantiating:

 Constructor<?> cons = clazz.getDeclaredConstructor();
cons.setAccessible(true);
Object obj = cons.newInstance();

4. Practical application scenarios

(1) Framework development (such as Spring, MyBatis)

Spring's dependency injection (DI) is achieved through reflection. It scans classes with annotations such as @Component and @Service , and creates instances and injects dependencies through reflection.

(2) Serialization and deserialization (such as Jackson, Gson)

The JSON library reads object fields by reflection, converts them to JSON strings, and vice versa. Even if the field is private, it can be accessed through setAccessible(true) .

(3) Unit tests (such as JUnit)

JUnit uses reflection to call methods marked by @Test annotation without hard-coded method names.

(4) ORM framework (such as Hibernate)

When mapping database records into Java objects, set field values by reflection to achieve automatic filling.

5. Performance and safety issues of reflection

Performance overhead

Reflection operation is slower than direct call, and the reasons include:

• Method calls require security checks
• The compiler cannot optimize the reflection code
• JIT optimization is limited

suggestion :

• Avoid frequent use of reflections in high-frequency paths
• Caches Method , Field , Constructor objects to reduce duplicate searches

Security risks

• Destroy encapsulation (access to private members)
• Possible bypassing security policies (such as security managers)
• It is easy to introduce vulnerabilities (such as deserialization attacks)

suggestion :

• Try to use only in controlled environments (such as internal frameworks)
• Avoid using reflection on untrusted inputs
• Restrict reflection access using a module system (Java 9)

6. Reflection and Generics

To obtain generic information in reflection, you need to use getGenericXxx() method:

 Method method = list.getClass().getMethod("add", Object.class);
Type returnType = method.getGenericReturnType(); // It may be ParameterizedType

For example, get the generic type in List<String> :

 ParameterizedType type = (ParameterizedType) field.getGenericType();
Type actualType = type.getActualTypeArguments()[0]; // String.class

7. Common Traps and Best Practices

• ? Use getDeclaredXxx() to get all members of this class (including private)
• ? Consider security impact before calling setAccessible(true)
• ? Cache reflective objects for performance
• ? Handle exceptions ( NoSuchFieldException , IllegalAccessException , etc.)
• ? Avoid abuse of reflections in business logic
• ? Do not use it to replace normal design patterns (such as policy patterns)

Conclusion

The Java Reflection API is a double-edged sword: it gives programs extremely strong dynamic capabilities and is widely used in the modern Java ecosystem, but it is also accompanied by performance loss and security risks. Only by understanding its principles, using them reasonably, and avoiding traps can it truly exert its value.

Basically, that’s all. If you master reflection, you will be one step closer to “understanding the framework source code”.

The above is the detailed content of The Ultimate Guide to Java Reflection API. For more information, please follow other related articles on the PHP Chinese website!