#

| Chapter 9 Security |

## 9.2 ClassLoader

Java supports dynamically loaded classes, so the class loading mechanism plays an important role in the Java security model. The default class loading mechanism in Java loads classes from local files found relative to directories specified by the `CLASSPATH` environment variable. The `CLASSPATH` environment variable should have a value made up of one or more directory paths separated by a colon. The path implied by the package of a class is relative to the directories specified in the `CLASSPATH` environment variable.

In contrast, an instance of the `java.lang.ClassLoader` class defines how classes are loaded over the network. You can specify a security policy for loading classes by defining a subclass of `ClassLoader` that implements the policy. The `loadClass()` method of a `ClassLoader` loads a top-level class, such as a subclass of `Applet`. That `ClassLoader` object then becomes associated with the loaded class. You can retrieve the `ClassLoader` object that loads the class by calling the `getClassLoader()` of an instance of the loaded class; every class in Java inherits this method from the `Object` class.

An object of a class loaded using a `ClassLoader` can attempt to load additional classes without explicitly using a `ClassLoader` object. The object does this by calling the `forName()` method of the `Class` class. However, if a `ClassLoader` object is associated with any pending method invocation in the current thread, the `forName()` method uses that `ClassLoader` to load the additional classes. In essence, this means that the object can only load classes through its associated `ClassLoader`.

If Java security is implemented correctly, an untrusted applet cannot escape the security policy implemented by the `ClassLoader` object used to load it because it cannot access any other `ClassLoader` objects. An applet should not be able to create its own `ClassLoader` objects. It is the responsibility of the `checkCreateClassLoader()` method of `SecurityManager` to enforce this restriction.

Because a `SecurityManager` can determine the `ClassLoader`, if any, used to load a class, it can use the `ClassLoader` to help determine the trustworthiness ofthe class. Classes loaded by different `ClassLoader` objects cannot accidentally be mixed up because a class is identified by the combination of its fully qualified name and its `ClassLoader`.

SecurityManager |  | Accessing the Environment