@Test
public void testReflectionAttack() throws Exception {

    String setup = "java.lang.reflect.Field field = org.drools.core.util.MVELSafeHelper.getDeclaredField(\"evaluator\");\n"
            + "System.out.println(field);\n"  
            + "field.setAccessible(true);\n"  
            + "field.set(null, \"new org.drools.core.util.MVELSafeHelper.RawMVELEvaluator()\");";
    try {
        Assert.assertEquals( SafeMVELEvaluator.class.getName(), MVELSafeHelper.getEvaluator().getClass().getName() );
        MVELSafeHelper.getEvaluator().eval(setup, new HashMap<String,Object>());
        Assert.fail("Should have raised an AccessControlException");
    } catch (PropertyAccessException e) {
        // test succeeded. the policy in place prevented the rule from executing field.setAccessible().
        //e.printStackTrace();
    }
}