Class SecureClassLoader

java.lang.Object

java.lang.ClassLoader

java.security.SecureClassLoader

Direct Known Subclasses:: URLClassLoader

public class SecureClassLoader extends ClassLoader

This class extends ClassLoader with additional support for defining classes with an associated code source and permissions.

API Note:: Permissions cannot be used for controlling access to resources as the Security Manager is no longer supported.
Since:: 1.2

Constructor Summary

SecureClassLoader()

SecureClassLoader(ClassLoader parent)

SecureClassLoader(String name,
 ClassLoader parent)

Modifier	Constructor	Description
`protected`	Creates a new `SecureClassLoader` using the system class loader as the parent.
`protected`	Creates a new `SecureClassLoader` using the specified parent class loader for delegation.
`protected`	Creates a new `SecureClassLoader` of the specified name and using the specified parent class loader for delegation.

Method Summary

Modifier and Type	Method	Description
`protected final Class<?>`	`defineClass(String name, byte[] b, int off, int len, CodeSource cs)`	Converts an array of bytes into an instance of class `Class`, with an optional CodeSource.
`protected final Class<?>`	`defineClass(String name, ByteBuffer b, CodeSource cs)`	Converts a `ByteBuffer` into an instance of class `Class`, with an optional CodeSource.
`protected PermissionCollection`	`getPermissions(CodeSource codesource)`	Returns the permissions for the given CodeSource object.

Methods declared in class ClassLoader

clearAssertionStatus, defineClass, defineClass, defineClass, defineClass, definePackage, findClass, findClass, findLibrary, findLoadedClass, findResource, findResource, findResources, findSystemClass, getClassLoadingLock, getDefinedPackage, getDefinedPackages, getName, getPackage, getPackages, getParent, getPlatformClassLoader, getResource, getResourceAsStream, getResources, getSystemClassLoader, getSystemResource, getSystemResourceAsStream, getSystemResources, getUnnamedModule, isRegisteredAsParallelCapable, loadClass, loadClass, registerAsParallelCapable, resolveClass, resources, setClassAssertionStatus, setDefaultAssertionStatus, setPackageAssertionStatus, setSigners

Modifier and Type	Method	Description
`void`	`clearAssertionStatus()`	Sets the default assertion status for this class loader to `false` and discards any package defaults or class assertion status settings associated with the class loader.
`protected final Class<?>`	`defineClass(byte[] b, int off, int len)`	Deprecated. Replaced by `defineClass(String, byte[], int, int)`
`protected final Class<?>`	`defineClass(String name, byte[] b, int off, int len)`	Converts an array of bytes into an instance of class `Class`.
`protected final Class<?>`	`defineClass(String name, byte[] b, int off, int len, ProtectionDomain protectionDomain)`	Converts an array of bytes into an instance of class `Class`, with a given `ProtectionDomain`.
`protected final Class<?>`	`defineClass(String name, ByteBuffer b, ProtectionDomain protectionDomain)`	Converts a `ByteBuffer` into an instance of class `Class`, with the given `ProtectionDomain`.
`protected Package`	`definePackage(String name, String specTitle, String specVersion, String specVendor, String implTitle, String implVersion, String implVendor, URL sealBase)`	Defines a package by name in this `ClassLoader`.
`protected Class<?>`	`findClass(String name)`	Finds the class with the specified binary name.
`protected Class<?>`	`findClass(String moduleName, String name)`	Finds the class with the given binary name in a module defined to this class loader.
`protected String`	`findLibrary(String libname)`	Returns the absolute path name of a native library.
`protected final Class<?>`	`findLoadedClass(String name)`	Returns the class with the given binary name if this loader has been recorded by the Java virtual machine as an initiating loader of a class with that binary name.
`protected URL`	`findResource(String name)`	Finds the resource with the given name.
`protected URL`	`findResource(String moduleName, String name)`	Returns a URL to a resource in a module defined to this class loader.
`protected Enumeration<URL>`	`findResources(String name)`	Returns an enumeration of `URL` objects representing all the resources with the given name.
`protected final Class<?>`	`findSystemClass(String name)`	Finds a class with the specified binary name, loading it if necessary.
`protected Object`	`getClassLoadingLock(String className)`	Returns the lock object for class loading operations.
`final Package`	`getDefinedPackage(String name)`	Returns a `Package` of the given name that has been defined by this class loader.
`final Package[]`	`getDefinedPackages()`	Returns all of the `Package`s that have been defined by this class loader.
`String`	`getName()`	Returns the name of this class loader or `null` if this class loader is not named.
`protected Package`	`getPackage(String name)`	Deprecated. If multiple class loaders delegate to each other and define classes with the same package name, and one such loader relies on the lookup behavior of `getPackage` to return a `Package` from a parent loader, then the properties exposed by the `Package` may not be as expected in the rest of the program.
`protected Package[]`	`getPackages()`	Returns all of the `Package`s that have been defined by this class loader and its ancestors.
`final ClassLoader`	`getParent()`	Returns the parent class loader for delegation.
`static ClassLoader`	`getPlatformClassLoader()`	Returns the platform class loader.
`URL`	`getResource(String name)`	Finds the resource with the given name.
`InputStream`	`getResourceAsStream(String name)`	Returns an input stream for reading the specified resource.
`Enumeration<URL>`	`getResources(String name)`	Finds all the resources with the given name.
`static ClassLoader`	`getSystemClassLoader()`	Returns the system class loader.
`static URL`	`getSystemResource(String name)`	Find a resource of the specified name from the search path used to load classes.
`static InputStream`	`getSystemResourceAsStream(String name)`	Open for reading, a resource of the specified name from the search path used to load classes.
`static Enumeration<URL>`	`getSystemResources(String name)`	Finds all resources of the specified name from the search path used to load classes.
`final Module`	`getUnnamedModule()`	Returns the unnamed `Module` for this class loader.
`final boolean`	`isRegisteredAsParallelCapable()`	Returns `true` if this class loader is registered as parallel capable, otherwise `false`.
`Class<?>`	`loadClass(String name)`	Loads the class with the specified binary name.
`protected Class<?>`	`loadClass(String name, boolean resolve)`	Loads the class with the specified binary name.
`protected static boolean`	`registerAsParallelCapable()`	Registers the caller as parallel capable.
`protected final void`	`resolveClass(Class<?> c)`	Links the specified class.
`Stream<URL>`	`resources(String name)`	Returns a stream whose elements are the URLs of all the resources with the given name.
`void`	`setClassAssertionStatus(String className, boolean enabled)`	Sets the desired assertion status for the named top-level class in this class loader and any nested classes contained therein.
`void`	`setDefaultAssertionStatus(boolean enabled)`	Sets the default assertion status for this class loader.
`void`	`setPackageAssertionStatus(String packageName, boolean enabled)`	Sets the package default assertion status for the named package.
`protected final void`	`setSigners(Class<?> c, Object[] signers)`	Sets the signers of a class.

Methods declared in class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Modifier and Type	Method	Description
`protected Object`	`clone()`	Creates and returns a copy of this object.
`boolean`	`equals(Object obj)`	Indicates whether some other object is "equal to" this one.
`protected void`	`finalize()`	Deprecated, for removal: This API element is subject to removal in a future version. Finalization is deprecated and subject to removal in a future release.
`final Class<?>`	`getClass()`	Returns the runtime class of this `Object`.
`int`	`hashCode()`	Returns a hash code value for this object.
`final void`	`notify()`	Wakes up a single thread that is waiting on this object's monitor.
`final void`	`notifyAll()`	Wakes up all threads that are waiting on this object's monitor.
`String`	`toString()`	Returns a string representation of the object.
`final void`	`wait()`	Causes the current thread to wait until it is awakened, typically by being notified or interrupted.
`final void`	`wait(long timeoutMillis)`	Causes the current thread to wait until it is awakened, typically by being notified or interrupted, or until a certain amount of real time has elapsed.
`final void`	`wait(long timeoutMillis, int nanos)`	Causes the current thread to wait until it is awakened, typically by being notified or interrupted, or until a certain amount of real time has elapsed.

Constructor Details

SecureClassLoader

protected SecureClassLoader(ClassLoader parent)

Creates a new SecureClassLoader using the specified parent class loader for delegation.

API Note:: If parent is specified as null (for the bootstrap class loader) then there is no guarantee that all platform classes are visible. See Run-time Built-in Class Loaders for information on the bootstrap class loader and other built-in class loaders.
Parameters:: parent - the parent ClassLoader, can be null for the bootstrap class loader

SecureClassLoader

protected SecureClassLoader()

Creates a new SecureClassLoader using the system class loader as the parent.

SecureClassLoader

protected SecureClassLoader(String name, ClassLoader parent)

Creates a new SecureClassLoader of the specified name and using the specified parent class loader for delegation.

API Note:: If parent is specified as null (for the bootstrap class loader) then there is no guarantee that all platform classes are visible. See Run-time Built-in Class Loaders for information on the bootstrap class loader and other built-in class loaders.
Parameters:: name - class loader name; or null if not named; parent - the parent class loader, can be null for the bootstrap class loader
Throws:: IllegalArgumentException - if the given name is empty.
Since:: 9

Method Details

defineClass

protected final Class<?> defineClass(String name, byte[] b, int off, int len, CodeSource cs)

Converts an array of bytes into an instance of class Class, with an optional CodeSource. Before the class can be used it must be resolved.

If a non-null CodeSource is supplied a ProtectionDomain is constructed and associated with the class being defined.

Parameters:: name - the expected name of the class, or null if not known, using '.' and not '/' as the separator and without a trailing ".class" suffix.; b - the bytes that make up the class data. The bytes in positions off through off+len-1 should have the format of a valid class file as defined by The Java Virtual Machine Specification.; off - the start offset in b of the class data; len - the length of the class data; cs - the associated CodeSource, or null if none
Returns:: the Class object created from the data, and optional CodeSource.
Throws:: ClassFormatError - if the data did not contain a valid class; IndexOutOfBoundsException - if either off or len is negative, or if off+len is greater than b.length.; SecurityException - if an attempt is made to add this class to a package that contains classes that were signed by a different set of certificates than this class, or if the class name begins with "java.".

defineClass

protected final Class<?> defineClass(String name, ByteBuffer b, CodeSource cs)

Converts a ByteBuffer into an instance of class Class, with an optional CodeSource. Before the class can be used it must be resolved.

If a non-null CodeSource is supplied a ProtectionDomain is constructed and associated with the class being defined.

Parameters:: name - the expected name of the class, or null if not known, using '.' and not '/' as the separator and without a trailing ".class" suffix.; b - the bytes that make up the class data. The bytes from positions b.position() through b.position() + b.limit() -1 should have the format of a valid class file as defined by The Java Virtual Machine Specification.; cs - the associated CodeSource, or null if none
Returns:: the Class object created from the data, and optional CodeSource.
Throws:: ClassFormatError - if the data did not contain a valid class; SecurityException - if an attempt is made to add this class to a package that contains classes that were signed by a different set of certificates than this class, or if the class name begins with "java.".
Since:: 1.5

getPermissions

protected PermissionCollection getPermissions(CodeSource codesource)

Returns the permissions for the given CodeSource object.

This method is invoked by the defineClass method which takes a CodeSource as an argument when it is constructing the ProtectionDomain for the class being defined.

Parameters:: codesource - the codesource.
Returns:: the permissions for the codesource.

© 1993, 2025, Oracle and/or its affiliates. All rights reserved.
Documentation extracted from Debian's OpenJDK Development Kit package.
Licensed under the GNU General Public License, version 2, with the Classpath Exception.
Various third party code in OpenJDK is licensed under different licenses (see Debian package).
Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates.