Discovering the perfect Java Supply Chain Attack vector and how it got fixed

Tue, 19 Nov 2024 12:00:00 +0000

You may have heard about the changes to annotation processing that have been done in Java 23. This post will cover the underlying topic, how I learned about it, and how it got fixed.

Background

To understand annotation processing and why it is even there, we first need to hop into our DeLorean and go back to the year ~~1955~~ 2005. So back then there were no build tools like Maven or Gradle, which we have nowadays. Java was still developed by Sun Microsystems and the newest version was 5. Java annotations were introduced with Java 5 but an API for processing them at build-time did not exist, so JSR 269 was born. The general idea seems to have been to allow the generation of (boilerplate) code and similar operations. Examples that use the concept nowadays are probably Lombok or Dagger (for the Android world) but these are usually run with dedicated plugins. I found an old video of a presentation about this topic - you may want to check it out for additional background information. JSR 269 was ultimately implemented and shipped in 2006 with Java 6. Most details of it were likely ignored over the years as better build tools such as Maven or Gradle gradually gained popularity.

Annotations on JAVAPRO International

Discovering the perfect Java Supply Chain Attack vector and how it got fixed

Background