title: Lotus Domino Java security issue using Google GSON
body: <p>Attempting to use the <a href="https://code.google.com/p/google-gson/" rel="nofollow noreferrer">Google GSON library</a> in a java method which is kicked off via an Xpage.</p>
  
  <p>I can create the gson object without a problem but then when attempting to call <code>gson.toJson(jsonObj)</code> I'm getting the following error: </p>
  
  <blockquote>
    <p>HTTP JVM: java.lang.SecurityException: not allowed to access members
    in class class java.util.HashMap</p>
    
    <p>HTTP JVM:  at
    lotus.notes.AgentSecurityManager.checkMemberAccess(Unknown Source)</p>
    
    <p>HTTP JVM:  at java.lang.Class.checkMemberAccess(Class.java:112)</p>
    
    <p>HTTP JVM:  at java.lang.Class.getDeclaredConstructor(Class.java:419)</p>
  </blockquote>
  
  <p>The code:</p>
  
  <pre><code>HashMap&lt;String, Object&gt; jsonObj = new HashMap&lt;String, Object&gt;();
  jsonObj.put("apiStatus", apiStatus);
  
  Gson gson = new Gson();
  String json = gson.toJson(jsonObj);  // Exception thrown on this line
  </code></pre>
  
  <p>I've seen <a href="https://stackoverflow.com/questions/15088051/security-issue-while-implementing-java-google-drive-api-with-domino-xpages">something similar here</a> but I've implemented both suggested policy changes, neither appear to have any effect:</p>
  
  <blockquote>
    <p>grant {
        permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; };</p>
    
    <p>grant codeBase "xspnsf://server:0/path/to/your/db.nsf/-" {
        permission java.security.AllPermission; };</p>
  </blockquote>