Developer's Guide to Web Application Security

Bytecode Verifier

When class files are loaded into the JVM, by default they are examined to make sure

the bytecode doesn’t have any problems.The bytecode is inspected after the class

loader has loaded it in.There are actually three levels of verification available to the

JVM, depending on what command-line argument is given when the JVM is started

(see Table 7.2).

Table 7.2 The Three Levels of Verification Available to the JVM

Argument Verification level

-verify Verifies both system classes and classes from a

class loader

-verifyremote (default) Verifies only outside classes loaded from a class

loader

-noverify Does not verify any classes

For example, if we w