Java Security, 2nd Edition

Implementing a Class Loader

Now we’ll look at how to implement a class loader. The class loader we implement will be able to extend the normal permissions that are granted via policy files, and it will enforce certain optional security features of the class loader.

Class Loader Classes

The basic class that defines a class loader is the ClassLoader class (java.lang.ClassLoader):

public abstract class ClassLoader

Turn a series of Java bytecodes into a class definition. This class does not define how the bytecodes are obtained but provides all other functionality needed to create the class definition.

However, the preferred class to use as the basis of a class loader is the SecureClassLoader class (java.security.SecureClassLoader):

public class SecureClassLoader extends ClassLoader

Turn a series of Java bytecodes into a class definition. This class adds secure functionality to the ClassLoader class, but it still does not define how bytecodes are obtained. Although this class is not abstract, you must subclass it in order to use it.

The secure class loader provides additional functionality in dealing with code sources and protection domains. You should always use this class as the basis of any class loader you work with; in fact, the ClassLoader class would be private were it not for historical reasons.

There is a third class in this category: the URLClassLoader class (java.net.URLClassLoader):

public class URLClassLoader extends SecureClassLoader

Load classes securely by obtaining the ...