Class SecureClassLoader

java.lang.Object

java.lang.ClassLoader

java.security.SecureClassLoader

Direct Known Subclasses:: URLClassLoader

public class SecureClassLoader extends ClassLoader

This class extends ClassLoader with additional support for defining classes with an associated code source and permissions.

API Note:: Permissions cannot be used for controlling access to resources as the Security Manager is no longer supported.
Since:: 1.2

Constructor Summary

SecureClassLoader()

SecureClassLoader(ClassLoader parent)

SecureClassLoader(String name,
 ClassLoader parent)

Modifier	Constructor	Description
`protected`	Creates a new `SecureClassLoader` using the system class loader as the parent.
`protected`	Creates a new `SecureClassLoader` using the specified parent class loader for delegation.
`protected`	Creates a new `SecureClassLoader` of the specified name and using the specified parent class loader for delegation.

Method Summary

Modifier and Type	Method	Description
`protected final Class<?>`	`defineClass(String name, byte[] b, int off, int len, CodeSource cs)`	Converts an array of bytes into an instance of class `Class`, with an optional CodeSource.
`protected final Class<?>`	`defineClass(String name, ByteBuffer b, CodeSource cs)`	Converts a `ByteBuffer` into an instance of class `Class`, with an optional CodeSource.
`protected PermissionCollection`	`getPermissions(CodeSource codesource)`	Returns the permissions for the given CodeSource object.

Methods declared in class ClassLoader

clearAssertionStatus, defineClass, defineClass, defineClass, defineClass, definePackage, findClass, findClass, findLibrary, findLoadedClass, findResource, findResource, findResources, findSystemClass, getClassLoadingLock, getDefinedPackage, getDefinedPackages, getName, getPackage, getPackages, getParent, getPlatformClassLoader, getResource, getResourceAsStream, getResources, getSystemClassLoader, getSystemResource, getSystemResourceAsStream, getSystemResources, getUnnamedModule, isRegisteredAsParallelCapable, loadClass, loadClass, registerAsParallelCapable, resolveClass, resources, setClassAssertionStatus, setDefaultAssertionStatus, setPackageAssertionStatus, setSigners

Methods declared in class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SecureClassLoader

protected SecureClassLoader(ClassLoader parent)

Creates a new SecureClassLoader using the specified parent class loader for delegation.

API Note:: If parent is specified as null (for the bootstrap class loader) then there is no guarantee that all platform classes are visible. See Run-time Built-in Class Loaders for information on the bootstrap class loader and other built-in class loaders.
Parameters:: parent - the parent ClassLoader, can be null for the bootstrap class loader

SecureClassLoader

protected SecureClassLoader()

Creates a new SecureClassLoader using the system class loader as the parent.

SecureClassLoader

protected SecureClassLoader(String name, ClassLoader parent)

Creates a new SecureClassLoader of the specified name and using the specified parent class loader for delegation.

API Note:: If parent is specified as null (for the bootstrap class loader) then there is no guarantee that all platform classes are visible. See Run-time Built-in Class Loaders for information on the bootstrap class loader and other built-in class loaders.
Parameters:: name - class loader name; or null if not named; parent - the parent class loader, can be null for the bootstrap class loader
Throws:: IllegalArgumentException - if the given name is empty.
Since:: 9

Method Details

defineClass

protected final Class<?> defineClass(String name, byte[] b, int off, int len, CodeSource cs)

Converts an array of bytes into an instance of class Class, with an optional CodeSource. Before the class can be used it must be resolved.

If a non-null CodeSource is supplied a ProtectionDomain is constructed and associated with the class being defined.

Parameters:: name - the expected name of the class, or null if not known, using '.' and not '/' as the separator and without a trailing ".class" suffix.; b - the bytes that make up the class data. The bytes in positions off through off+len-1 should have the format of a valid class file as defined by The Java Virtual Machine Specification.; off - the start offset in b of the class data; len - the length of the class data; cs - the associated CodeSource, or null if none
Returns:: the Class object created from the data, and optional CodeSource.
Throws:: ClassFormatError - if the data did not contain a valid class; IndexOutOfBoundsException - if either off or len is negative, or if off+len is greater than b.length.; SecurityException - if an attempt is made to add this class to a package that contains classes that were signed by a different set of certificates than this class, or if the class name begins with "java.".

defineClass

protected final Class<?> defineClass(String name, ByteBuffer b, CodeSource cs)

Converts a ByteBuffer into an instance of class Class, with an optional CodeSource. Before the class can be used it must be resolved.

If a non-null CodeSource is supplied a ProtectionDomain is constructed and associated with the class being defined.

Parameters:: name - the expected name of the class, or null if not known, using '.' and not '/' as the separator and without a trailing ".class" suffix.; b - the bytes that make up the class data. The bytes from positions b.position() through b.position() + b.limit() -1 should have the format of a valid class file as defined by The Java Virtual Machine Specification.; cs - the associated CodeSource, or null if none
Returns:: the Class object created from the data, and optional CodeSource.
Throws:: ClassFormatError - if the data did not contain a valid class; SecurityException - if an attempt is made to add this class to a package that contains classes that were signed by a different set of certificates than this class, or if the class name begins with "java.".
Since:: 1.5

getPermissions

protected PermissionCollection getPermissions(CodeSource codesource)

Returns the permissions for the given CodeSource object.

This method is invoked by the defineClass method which takes a CodeSource as an argument when it is constructing the ProtectionDomain for the class being defined.

Parameters:: codesource - the codesource.
Returns:: the permissions for the codesource.

© 1993, 2025, Oracle and/or its affiliates. All rights reserved.
Documentation extracted from Debian's OpenJDK Development Kit package.
Licensed under the GNU General Public License, version 2, with the Classpath Exception.
Various third party code in OpenJDK is licensed under different licenses (see Debian package).
Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates.
https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/SecureClassLoader.html