Java Security Solutions

The class loader is simply an object that is responsible for loading and verifying a Java class. The class loader checks for imported classes that are referenced in the class by searching through the CLASSPATH . The class loader also checks for any security manager and, after the class is loaded, the class is handed off to the Java Runtime Environment (JRE) for execution.

The java.lang.ClassLoader is the base class that creates the class loader object. The ClassLoader class is an abstract class because it returns the current instance when calling the Class.getClassLoader ( ) method. All Java classes can call the Class.getClassLoader ( ) method to retrieve the reference to the executing class loader that will load itself. The class could be as simple as an Array class and execute the Class.getClassLoader ( ), and it will return the class loader that loaded the Array class.

Some applications may implement subclasses of the ClassLoader class to extend operations when loading a class. Several come deployed with Java 2. Figure 18-2 displays the extended classes that are also deployed in JDK 1.4.

Figure 18-2: Some ClassLoader extension classes

A class loader is any class that adheres to the ClassLoader interface. These interfaces include the following:

• java.lang.ClassLoader : This class loader represents the base class loader from which all other class loaders will be derived.

• java.security.SecureClassLoader : This class loader was introduced in Java 2 to provide the capability to associate classes with permissions and the code source. The permissions are retrieved by the system policy by default.

• java.net.URLClassLoader : This class loader was introduced in Java 2 to provide the capability to load classes from a list of URLs.

• java.rmi.server.RMIClassLoader : This class loader was introduced in Java 1.1 to provide RMI applications during marshaling and unmarshaling of classes passed as parameters. The RMIClassLoader loads classes from the network using a list of URLs.