From 32e6aee7172744b6138341fe5268899eaef51efa Mon Sep 17 00:00:00 2001
From: Naveed Khan <dxbnaveed.k@gmail.com>
Date: Tue, 7 Jul 2026 13:42:31 +0530
Subject: [PATCH] suppress class and declaringClass properties in BeanMap

BeanMap.initialize introspected the bean directly and registered the
class/declaringClass pseudo-properties, so BeanMap.get("class") returned
the bean's class loader that PropertyUtilsBean suppresses by default. Skip
both names during initialization.
---
 .../apache/commons/beanutils2/BeanMap.java    |  5 ++++
 .../commons/beanutils2/BeanMapTest.java       | 30 +++++++++++++++----
 2 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/apache/commons/beanutils2/BeanMap.java b/src/main/java/org/apache/commons/beanutils2/BeanMap.java
index 927573c2e..4c0d2cd3b 100644
--- a/src/main/java/org/apache/commons/beanutils2/BeanMap.java
+++ b/src/main/java/org/apache/commons/beanutils2/BeanMap.java
@@ -479,6 +479,11 @@ private void initialize() {
                 for (final PropertyDescriptor propertyDescriptor : propertyDescriptors) {
                     if (propertyDescriptor != null) {
                         final String name = propertyDescriptor.getName();
+                        if ("class".equals(name) || "declaringClass".equals(name)) {
+                            // These pseudo-properties expose the bean's ClassLoader; skip them to match the
+                            // suppression PropertyUtilsBean applies by default (see SuppressPropertiesBeanIntrospector).
+                            continue;
+                        }
                         final Method readMethod = propertyDescriptor.getReadMethod();
                         final Method writeMethod = propertyDescriptor.getWriteMethod();
                         final Class<?> aType = propertyDescriptor.getPropertyType();
diff --git a/src/test/java/org/apache/commons/beanutils2/BeanMapTest.java b/src/test/java/org/apache/commons/beanutils2/BeanMapTest.java
index 6604cfe12..2a8017517 100644
--- a/src/test/java/org/apache/commons/beanutils2/BeanMapTest.java
+++ b/src/test/java/org/apache/commons/beanutils2/BeanMapTest.java
@@ -17,7 +17,9 @@
 package org.apache.commons.beanutils2;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 import static org.junit.jupiter.api.Assumptions.assumeFalse;
@@ -176,7 +178,7 @@ protected Object computeIfAbsent(final String key, final Function<? super String
     @Override
     public Object[] getNewSampleValues() {
         final Object[] values = { Integer.valueOf(223), Long.valueOf(23341928234L), Double.valueOf(23423.34), Float.valueOf(213332.12f),
-                Short.valueOf((short) 234), Byte.valueOf((byte) 20), Character.valueOf('b'), Integer.valueOf(232), "SomeNewStringValue", new Object(), null, };
+                Short.valueOf((short) 234), Byte.valueOf((byte) 20), Character.valueOf('b'), Integer.valueOf(232), "SomeNewStringValue", new Object(), };
         return values;
     }
 
@@ -188,12 +190,12 @@ public Object[] getNewSampleValues() {
     // To:
     // "some\2Value",
     //
-    // Then, I manually added the "class" key, which is a property that exists for
-    // all beans (and all objects for that matter.
+    // The "class" pseudo-property is intentionally absent: it is suppressed so the bean's
+    // ClassLoader is not reachable through the map.
     @Override
     public String[] getSampleKeys() {
         final String[] keys = { "someIntValue", "someLongValue", "someDoubleValue", "someFloatValue", "someShortValue", "someByteValue", "someCharValue",
-                "someIntegerValue", "someStringValue", "someObjectValue", "class", };
+                "someIntegerValue", "someStringValue", "someObjectValue", };
         return keys;
     }
 
@@ -201,8 +203,7 @@ public String[] getSampleKeys() {
     @Override
     public Object[] getSampleValues() {
         final Object[] values = { Integer.valueOf(1234), Long.valueOf(1298341928234L), Double.valueOf(123423.34), Float.valueOf(1213332.12f),
-                Short.valueOf((short) 134), Byte.valueOf((byte) 10), Character.valueOf('a'), Integer.valueOf(1432), "SomeStringValue", objectInFullMap,
-                BeanWithProperties.class, };
+                Short.valueOf((short) 134), Byte.valueOf((byte) 10), Character.valueOf('a'), Integer.valueOf(1432), "SomeStringValue", objectInFullMap, };
         return values;
     }
 
@@ -283,6 +284,23 @@ void testBeanMapClone() {
         }
     }
 
+    /**
+     * The {@code class} and (for enums) {@code declaringClass} pseudo-properties expose the bean's {@link ClassLoader} and must not be reachable through the map,
+     * matching the suppression {@link PropertyUtilsBean} applies by default.
+     */
+    @Test
+    void testClassPropertyNotExposed() {
+        final BeanMap map = new BeanMap(new BeanWithProperties());
+        assertFalse(map.containsKey("class"), "class must not be exposed as a property");
+        assertNull(map.get("class"));
+        assertNull(map.getReadMethod("class"));
+
+        final BeanMap enumMap = new BeanMap(java.time.DayOfWeek.MONDAY);
+        assertFalse(enumMap.containsKey("class"), "class must not be exposed as a property");
+        assertFalse(enumMap.containsKey("declaringClass"), "declaringClass must not be exposed as a property");
+        assertNull(enumMap.get("declaringClass"));
+    }
+
     @Test
     void testBeanMapPutAllWriteable() {
         final BeanMap map1 = (BeanMap) makeFullMap();