1 files changed, 21 insertions, 2 deletions
diff --git a/src/jdk/nashorn/internal/runtime/linker/ReflectionCheckLinker.java b/src/jdk/nashorn/internal/runtime/linker/ReflectionCheckLinker.java
index 39f93642..32f30764 100644
--- a/src/jdk/nashorn/internal/runtime/linker/ReflectionCheckLinker.java
+++ b/src/jdk/nashorn/internal/runtime/linker/ReflectionCheckLinker.java
@@ -26,6 +26,7 @@
 package jdk.nashorn.internal.runtime.linker;
 
 import java.lang.reflect.Modifier;
+import java.lang.reflect.Proxy;
 import jdk.internal.dynalink.CallSiteDescriptor;
 import jdk.internal.dynalink.linker.GuardedInvocation;
 import jdk.internal.dynalink.linker.LinkRequest;
@@ -47,6 +48,7 @@ final class ReflectionCheckLinker implements TypeBasedGuardingDynamicLinker{
         if (type == Class.class || ClassLoader.class.isAssignableFrom(type)) {
             return true;
         }
+
         final String name = type.getName();
         return name.startsWith("java.lang.reflect.") || name.startsWith("java.lang.invoke.");
     }
@@ -59,9 +61,25 @@ final class ReflectionCheckLinker implements TypeBasedGuardingDynamicLinker{
         return null;
     }
 
-    static void checkReflectionAccess(Class<?> clazz) {
+    private static boolean isReflectiveCheckNeeded(final Class<?> type, final boolean isStatic) {
+         // special handling for Proxy subclasses
+         if (Proxy.class.isAssignableFrom(type)) {
+            if (Proxy.isProxyClass(type)) {
+                // real Proxy class - filter only static access
+                return isStatic;
+            }
+
+            // fake Proxy subclass - filter it always!
+            return true;
+        }
+
+        // check for any other reflective Class
+        return isReflectionClass(type);
+    }
+
+    static void checkReflectionAccess(final Class<?> clazz, final boolean isStatic) {
         final SecurityManager sm = System.getSecurityManager();
-        if (sm != null && isReflectionClass(clazz)) {
+        if (sm != null && isReflectiveCheckNeeded(clazz, isStatic)) {
             checkReflectionPermission(sm);
         }
     }
@@ -77,6 +95,7 @@ final class ReflectionCheckLinker implements TypeBasedGuardingDynamicLinker{
                 if(CallSiteDescriptorFactory.tokenizeOperators(desc).contains("getProp")) {
                     if ("static".equals(desc.getNameToken(CallSiteDescriptor.NAME_OPERAND))) {
                         if (Context.isAccessibleClass((Class<?>)self) && !isReflectionClass((Class<?>)self)) {
+
                             // If "getProp:static" passes access checks, allow access.
                             return;
                         }