Message9302

I have identified a workaround and the likely problem, which is in determining the accessibility of some static classes, like java.util.Arrays, when creating a list of available classes in a given package with PackageManager#doDir. Explicit, nonstarred imports don't go through this directory construction process, so they are not impacted.

The workaround is to set the following in the Jython registry file or on the command line with -D

python.security.respectJavaAccessibility=false

The problem is most likely in PackageManager.checkAccess, which is very old code that attempts to find the access permission of the class. In reviewing
Java 7 (http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-4.html#jvms-4.1) vs
Java 8 (http://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.1) I didn't see any differences that should cause this problem, but there's certainly room for error in how checkAccess is currently implemented.

checkAccess should instead use ASM, specifically http://asm.ow2.org/asm40/javadoc/user/org/objectweb/asm/ClassVisitor.html#visit(int, int, java.lang.String, java.lang.String, java.lang.String, java.lang.String[]), which provides exactly what we need.