Private Classes can be instantiated by reflection from outside their scope

[scabug]

Test case:

package testing {

package privatetesting {
  private class PrivateClass
  private[privatetesting] class PrivateToPackageClass
}

object TestingObject {
  def main(args: Array[String]) {
    println(Class.forName("testing.privatetesting.PrivateClass").getConstructor().newInstance())
    println(Class.forName("testing.privatetesting.PrivateToPackageClass").getConstructor().newInstance())
  }
}

}

Expected output: IllegalAccessException, or some such error

Actual output:

testing.privatetesting.PrivateClass@47808199
testing.privatetesting.PrivateToPackageClass@5ca46701

[scabug]

Imported From: https://issues.scala-lang.org/browse/SI-3276?orig=1
Reporter: Graham Lea (grlea)

[scabug]

@dubochet said:
There is probably not much we can do: Scala access annotation are not reflection-safe. I'll check with the team during the next meeting.

[scabug]

@dubochet said:
As I thought, this is not something we can change.

The fact that Java reflection allows invalid access on Scala programs is an inherent problem with the compilation of non-Java languages to the JVM. There is nothing we can do.

The longer-term answer to such issues is that we are developing a Scala reflection library that will not suffer from those problems.