From 83d56dab2844cdac1ca8680ad6ef00b0cc0cf703 Mon Sep 17 00:00:00 2001
From: Andreas Dangel <andreas.dangel@pmd-code.org>
Date: Fri, 3 Sep 2021 09:31:03 +0200
Subject: [PATCH] [java] AvoidAccessibilityAlteration: allow
 setAccessible(false)

This restores the cheks for the Java language access control.
---
 .../main/resources/category/java/errorprone.xml  |  1 +
 .../xml/AvoidAccessibilityAlteration.xml         | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/pmd-java/src/main/resources/category/java/errorprone.xml b/pmd-java/src/main/resources/category/java/errorprone.xml
index 0bfa9e4138..475e47af45 100644
--- a/pmd-java/src/main/resources/category/java/errorprone.xml
+++ b/pmd-java/src/main/resources/category/java/errorprone.xml
@@ -76,6 +76,7 @@ is assumed to be deliberate and is not reported.
 <![CDATA[
 //PrimaryPrefix
     [Name[ends-with(@Image, '.setAccessible')]]
+    [not(following-sibling::PrimarySuffix/Arguments//BooleanLiteral[@True = false()])]
     [pmd-java:typeIs('java.lang.reflect.AccessibleObject')]
     (: exclude anonymous privileged action classes :)
     [not(ancestor::AllocationExpression[pmd-java:typeIs('java.security.PrivilegedAction')])]
diff --git a/pmd-java/src/test/resources/net/sourceforge/pmd/lang/java/rule/errorprone/xml/AvoidAccessibilityAlteration.xml b/pmd-java/src/test/resources/net/sourceforge/pmd/lang/java/rule/errorprone/xml/AvoidAccessibilityAlteration.xml
index 9e215b28eb..d8d654159c 100644
--- a/pmd-java/src/test/resources/net/sourceforge/pmd/lang/java/rule/errorprone/xml/AvoidAccessibilityAlteration.xml
+++ b/pmd-java/src/test/resources/net/sourceforge/pmd/lang/java/rule/errorprone/xml/AvoidAccessibilityAlteration.xml
@@ -165,4 +165,20 @@ public class NoViolation { {
 } }
         ]]></code>
     </test-code>
+
+    <test-code>
+        <description>setAccessible(false) is ok</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+import java.lang.reflect.Constructor;
+
+public class Violation {
+    private void invalidSetAccessCalls() throws NoSuchMethodException, SecurityException {
+        Constructor<?> constructor = this.getClass().getDeclaredConstructor(String.class);
+        // call to setAccessible with false - that's ok
+        constructor.setAccessible(false);
+    }
+}
+        ]]></code>
+    </test-code>
 </test-data>
\ No newline at end of file