Java security: Sandboxing plugins loaded via URLClassLoader

From the docs: The AccessControlContext of the thread that created the instance of URLClassLoader will be used when subsequently loading classes and resources. The classes that are loaded are by default granted permission only to access the URLs specified when the URLClassLoader was created. The URLClassLoader is doing exactly as its says, the AccessControlContext is … Read more

Is it possible to “add” to classpath dynamically in java?

You can use a java.net.URLClassLoader to load classes with any program defined list of URL’s you wish: public class URLClassLoader extends SecureClassLoader This class loader is used to load classes and resources from a search path of URLs referring to both JAR files and directories. Any URL that ends with a “https://stackoverflow.com/” is assumed to … Read more

Add jar to classpath at runtime under java 9

The JavaSE9 release notes read about the same : The application class loader is no longer an instance of java.net.URLClassLoader (an implementation detail that was never specified in previous releases). Code that assumes that ClassLoader::getSytemClassLoader returns a URLClassLoader object will need to be updated. Note that Java SE and the JDK do not provide an … Read more

Java 9, compatability issue with ClassLoader.getSystemClassLoader

You’ve run into the fact that the system class loader is no longer a URLClassLoader. As indicated by ClassLoader::getSystemClassLoader‘s return type, this was an implementation detail, albeit one that a non-negligible amount of code relied upon. Judging by the comments, you are looking for a way to dynamically load classes at run time. As Alan … Read more