apply default package rejections

Author: mcollovati

flow-plugins/flow-plugin-base/src/main/java/com/vaadin/flow/server/scanner/ReflectionsClassFinder.java

@@ -53,8 +53,42 @@
  * @since 2.0
  */
 public class ReflectionsClassFinder implements ClassFinder {
+    /**
+     * System property name to be used to disable default package filtering
+     * during class scan. See {@link #applyScannerPackageFilters(ClassGraph)}
+     * and {@link #DEFAULT_REJECTED_PACKAGES}
+     */
+    public static final String DISABLE_DEFAULT_PACKAGE_FILTER = "vaadin.classfinder.disableDefaultPackageFilter";
+
+    private static final String[] DEFAULT_REJECTED_PACKAGES = new String[] {
+            "antlr", "cglib", "ch.quos.logback", "commons-codec",
+            "commons-fileupload", "commons-io", "commons-logging",
+            "com.fasterxml", "tools.jackson", "com.google", "com.h2database",
+            "com.helger", "com.vaadin.external.atmosphere", "com.vaadin.webjar",
+            "junit", "net.bytebuddy", "org.apache", "org.aspectj",
+            "org.bouncycastle", "org.dom4j", "org.easymock",
+            "org.eclipse.persistence", "org.hamcrest", "org.hibernate",
+            "org.javassist", "org.jboss", "org.jsoup", "org.seleniumhq",
+            "org.slf4j", "org.atmosphere", "org.springframework",
+            "org.webjars.bowergithub", "org.yaml",
+
+            "java.*", "javax.*", "javafx.*", "com.sun.*", "oracle.deploy",
+            "oracle.javafx", "oracle.jrockit", "oracle.jvm", "oracle.net",
+            "oracle.nio", "oracle.tools", "oracle.util", "oracle.webservices",
+            "oracle.xmlns",
+
+            "com.intellij.*", "org.jetbrains",
+
+            "com.vaadin.external.gwt", "javassist.*", "io.methvin",
+            "com.github.javaparser", "oshi.*", "io.micrometer", "jakarta.*",
+            "com.nimbusds", "elemental.util", "org.reflections",
+            "org.aopalliance", "org.objectweb",
+
+            "com.vaadin.hilla", "com.vaadin.copilot" };
+
     private static final Logger LOGGER = LoggerFactory
             .getLogger(ReflectionsClassFinder.class);
+
     private final transient ClassLoader classLoader;
 
     // Cache all discovered classes by annotation
@@ -108,7 +142,7 @@ public ReflectionsClassFinder(ClassLoader classLoader, URL... urls) {
                 .ignoreClassVisibility() // Scan non-public classes
                 .filterClasspathElements(
                         path -> !path.endsWith("module-info.class"));
-
+        applyScannerPackageFilters(classGraph);
         if (VersionFinder.JAVA_MAJOR_VERSION < 24) {
             // Not available on Java 24+ currently, because of the deprecation
             // of the Unsafe API
@@ -296,4 +330,10 @@ private Map<String, Set<String>> buildSubtypeCache(
 
         return cache;
     }
+
+    private void applyScannerPackageFilters(ClassGraph classGraph) {
+        if (!Boolean.getBoolean(DISABLE_DEFAULT_PACKAGE_FILTER)) {
+            classGraph.rejectPackages(DEFAULT_REJECTED_PACKAGES);
+        }
+    }
 }

flow-plugins/flow-plugin-base/src/test/java/com/vaadin/flow/server/scanner/ReflectionsClassFinderTest.java

@@ -25,6 +25,7 @@
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.Arrays;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
@@ -86,6 +87,42 @@ public void getSubTypesOf_orderIsDeterministic() {
         Assert.assertEquals(a2, a3);
     }
 
+    @Test
+    public void getSubTypesOf_rejectNotVaadinKnownPackages() throws Exception {
+        urls = Arrays.copyOf(urls, urls.length + 1);
+        urls[urls.length - 1] = createTestModule("module-4",
+                "org.springframework.feature.ui", "SpringUIComponent", "2.0.0");
+        Set<String> result = new ReflectionsClassFinder(urls)
+                .getSubTypesOf(Component.class).stream().map(Class::getName)
+                .collect(Collectors.toSet());
+        Assert.assertFalse(
+                "Classes from know not-UI packages should be rejected by default",
+                result.contains(
+                        "org.springframework.feature.ui.SpringUIComponent"));
+    }
+
+    @Test
+    public void getSubTypesOf_defaultRejectDisabled_scansAllPackages()
+            throws Exception {
+        urls = Arrays.copyOf(urls, urls.length + 1);
+        urls[urls.length - 1] = createTestModule("module-4",
+                "org.springframework.feature.ui", "SpringUIComponent", "2.0.0");
+        System.setProperty(
+                ReflectionsClassFinder.DISABLE_DEFAULT_PACKAGE_FILTER, "true");
+        try {
+            Set<String> result = new ReflectionsClassFinder(urls)
+                    .getSubTypesOf(Component.class).stream().map(Class::getName)
+                    .collect(Collectors.toSet());
+            Assert.assertTrue(
+                    "Classes from know not-UI packages should be found when default rejection is disabled",
+                    result.contains(
+                            "org.springframework.feature.ui.SpringUIComponent"));
+        } finally {
+            System.clearProperty(
+                    ReflectionsClassFinder.DISABLE_DEFAULT_PACKAGE_FILTER);
+        }
+    }
+
     @Test
     public void getAnnotatedClasses_orderIsDeterministic() {
         List<String> a1 = toList(new ReflectionsClassFinder(urls)