1

I'm working on a user-related service that handles personal information. While writing unit tests with Mockito, I ran into dependency issues with Byte Buddy, which prevented me from using the latest version of Mockito.

As a workaround, I'm using Mockito version 1.10.19. To make the tests run successfully, I added the following configuration to my pom.xml:

<plugin> <groupId>org.apache.maven.plugins</groupId> <artifactId>maven-surefire-plugin</artifactId> <version>3.2.5</version> <configuration> <argLine>--add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED</argLine> </configuration> </plugin>

Concern

My senior mentioned that since this is a user service dealing with personal data, I need to make sure that the configuration above doesn't:

  • Interfere with anything outside the test scope, or
  • Pose any security risks to the service or user data.

Additional context

I've also tried mocking dependencies manually, but since the service involves JDBI, it’s been challenging to handle. So I’d like clarification on:

  1. Whether it’s safe to continue using Mockito (with this setup).
  2. If there’s a better or safer approach for testing JDBI-based services.
  3. Any useful articles or resources related to testing with Mockito and JDBI.
Improve this question
4
  • The --add-opens options don't permanently change anything. Putting them in your Surefire configuration will only affect your unit tests. Commented Oct 21 at 10:54
  • @Slaw can you link any article or resources based on which you are saying it will only effect unit tests, it will help me Commented Oct 21 at 11:17
  • baeldung.com/java-maven-pass-jvm-arguments is the article I found @ApurvaAgarwal Commented Oct 21 at 11:48
  • What kind of article are you looking for? The --add-opens option, like all JVM options, only has an effect if it's actually passed when launching a JVM. How a JVM option is passed can vary, but if an option is not passed then it cannot have an effect. Additionally, the Maven Surefire plugin is for running unit tests. Configuring the plugin will only affect its own execution. The configuration won't magically leak into your production environment. In fact, Maven itself won't even be in your production environment to begin with. Commented Oct 21 at 18:10

1 Answer 1

Reset to default
1

I agree that you should be (very!) careful with your users' personal info, but the concern here is unfounded.

First, this configuration is only about the surefire plugin, used to run tests. It would have no impact on the production JVM instance your service uses.

Second, even if it did, all that --add-opens does is allow access to non-public members in the specified java.base modules. Since the user data is clearly not stored in those modules, it shouldn't be an issue.

But most improtantly - you should never run your tests on an environment with real user data!
Assuming you follow this rule, it really doesn't matter what configuration or JVM options you pass to the JVM executing these tests.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.