Internal packages are not exported in OSGI jar

[niralepatel]

Gson version

2.9.1

Java / Android version

Java 1.8

Used tools

Gradle

Description

We were using 2.5 version and now we want to upgrade to 2.9.1 version to resolve security vulnerabilities.
We are using LinkedTreeMap class but now with 2.9.1 versions, LinkedTreeMap is giving compilation issues.
We suspect the reason is, The package com.google.gson.internal is not present under Export-Package section in manifest.mf

2.5:-
Export-Package: com.google.gson;version=2.5, com.google.gson.annotatio
ns;version=2.5, com.google.gson.reflect;version=2.5, com.google.gson.
stream;version=2.5, com.google.gson.internal;version=2.5, com.google.
gson.internal.bind;version=2.5

2.6 onwards
Export-Package: com.google.gson;uses:="com.google.gson.reflect,com.goo
gle.gson.stream";version="2.6.2",com.google.gson.annotations;version=
"2.6.2",com.google.gson.reflect;version="2.6.2",com.google.gson.strea
m;version="2.6.2"

In our manifest, we try to import as below,
Import-Package:
com.google.gson.internal;version="2.9.1"

Please note If we make this as,
com.google.gson;version="2.9.1"

then it works fine, but we suspect at run time it might give ClassNotfound error as this internal package is not exported in gson and not imported at our side.

Expected behavior

It should export internal package same as 2.5 version

Actual behavior

It is not present in Export-package section

Why it was removed, because it was present in 2.5 version? Any reason behind this? Please help me with the questions

[Marcono1234]

That sounds intentional to me. As the package name suggests LinkedTreeMap is an internal class and part of the Gson implementation details. They are intentionally not publicly exposed (neither in the OSGi metadata nor in module-info.class) so that users don't rely on these classes, and that they can be changed or possibly even be removed depending on Gson's internal usage.

However, why are you using Gson's LinkedTreeMap class in the first place instead of java.util.LinkedHashMap?
It appears the reason why the LinkedTreeMap class was originally added to Gson was to protect against a denial-of-service attack in the JDK class LinkedHashMap (respectively HashMap). But it seems that was resolved in JDK 8, so there might not be any need for LinkedTreeMap anymore, see also #1992 (comment).

[Marcono1234]

I am going to close this since it is unlikely that Gson will allow access to internal implementation classes in the future, since that makes maintenance more difficult.

As mentioned above, if you currently rely on an internal class of Gson, please describe your use case. Maybe we can find an alternative for it.