SecureClassLoader (Java SE 21 & JDK 21)
Description: declaration: module: java.base, package: java.security, class: SecureClassLoader
Keywords: java.security.SecureClassLoader class

Module java.base
Package java.security

# Class SecureClassLoader

java.lang.Object
java.lang.ClassLoader
java.security.SecureClassLoader

Direct Known Subclasses:
  `URLClassLoader`

public class SecureClassLoader extends ClassLoader
This class extends `ClassLoader` with additional support for defining classes with an associated code source and permissions which are retrieved by the system policy by default.

Since:
  1.2

- ## Constructor Summary

  Constructors
  Modifier
  Constructor
  Description
  `protected`
  `SecureClassLoader()`
  Creates a new `SecureClassLoader` using the default parent class loader for delegation.
  `protected`
  `SecureClassLoader(ClassLoader parent)`
  Creates a new `SecureClassLoader` using the specified parent class loader for delegation.
  `protected`
  `SecureClassLoader(String name, ClassLoader parent)`
  Creates a new `SecureClassLoader` of the specified name and using the specified parent class loader for delegation.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `protected final Class<?>`
  `defineClass(String name, byte[] b, int off, int len, CodeSource cs)`
  Converts an array of bytes into an instance of class `Class`, with an optional CodeSource.
  `protected final Class<?>`
  `defineClass(String name, ByteBuffer b, CodeSource cs)`
  Converts a `ByteBuffer` into an instance of class `Class`, with an optional CodeSource.
  `protected PermissionCollection`
  `getPermissions(CodeSource codesource)`
  Returns the permissions for the given CodeSource object.

  ### Methods declared in class java.lang.ClassLoader

  `clearAssertionStatus, defineClass, defineClass, defineClass, defineClass, definePackage, findClass, findClass, findLibrary, findLoadedClass, findResource, findResource, findResources, findSystemClass, getClassLoadingLock, getDefinedPackage, getDefinedPackages, getName, getPackage, getPackages, getParent, getPlatformClassLoader, getResource, getResourceAsStream, getResources, getSystemClassLoader, getSystemResource, getSystemResourceAsStream, getSystemResources, getUnnamedModule, isRegisteredAsParallelCapable, loadClass, loadClass, registerAsParallelCapable, resolveClass, resources, setClassAssertionStatus, setDefaultAssertionStatus, setPackageAssertionStatus, setSigners`

  ### Methods declared in class java.lang.Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- ## Constructor Details

  - ### SecureClassLoader

    protected SecureClassLoader(ClassLoader parent)
    Creates a new `SecureClassLoader` using the specified parent class loader for delegation.

    If there is a security manager, this method first calls the security manager's `checkCreateClassLoader` method to ensure creation of a class loader is allowed.

    Parameters:
      `parent` - the parent ClassLoader
    Throws:
      `SecurityException` - if a security manager exists and its `checkCreateClassLoader` method doesn't allow creation of a class loader.
    See Also:
      - `SecurityManager.checkCreateClassLoader()`

  - ### SecureClassLoader

    protected SecureClassLoader()
    Creates a new `SecureClassLoader` using the default parent class loader for delegation.

    If there is a security manager, this method first calls the security manager's `checkCreateClassLoader` method to ensure creation of a class loader is allowed.

    Throws:
      `SecurityException` - if a security manager exists and its `checkCreateClassLoader` method doesn't allow creation of a class loader.
    See Also:
      - `SecurityManager.checkCreateClassLoader()`

  - ### SecureClassLoader

    protected SecureClassLoader(String name, ClassLoader parent)
    Creates a new `SecureClassLoader` of the specified name and using the specified parent class loader for delegation.
    Parameters:
      `name` - class loader name; or `null` if not named
      `parent` - the parent class loader
    Throws:
      `IllegalArgumentException` - if the given name is empty.
      `SecurityException` - if a security manager exists and its `SecurityManager.checkCreateClassLoader()` method doesn't allow creation of a class loader.
    Since:
      9

- ## Method Details

  - ### defineClass

    protected final Class<?> defineClass(String name, byte[] b, int off, int len, CodeSource cs)
    Converts an array of bytes into an instance of class `Class`, with an optional CodeSource. Before the class can be used it must be resolved.

    If a non-null CodeSource is supplied a ProtectionDomain is constructed and associated with the class being defined.

    Parameters:
      `name` - the expected name of the class, or `null` if not known, using '.' and not '/' as the separator and without a trailing ".class" suffix.
      `b` - the bytes that make up the class data. The bytes in positions `off` through `off+len-1` should have the format of a valid class file as defined by The Java Virtual Machine Specification.
      `off` - the start offset in `b` of the class data
      `len` - the length of the class data
      `cs` - the associated CodeSource, or `null` if none
    Returns:
      the `Class` object created from the data, and optional CodeSource.
    Throws:
      `ClassFormatError` - if the data did not contain a valid class
      `IndexOutOfBoundsException` - if either `off` or `len` is negative, or if `off+len` is greater than `b.length`.
      `SecurityException` - if an attempt is made to add this class to a package that contains classes that were signed by a different set of certificates than this class, or if the class name begins with "java.".

  - ### defineClass

    protected final Class<?> defineClass(String name, ByteBuffer b, CodeSource cs)
    Converts a `ByteBuffer` into an instance of class `Class`, with an optional CodeSource. Before the class can be used it must be resolved.

    If a non-null CodeSource is supplied a ProtectionDomain is constructed and associated with the class being defined.

    Parameters:
      `name` - the expected name of the class, or `null` if not known, using '.' and not '/' as the separator and without a trailing ".class" suffix.
      `b` - the bytes that make up the class data. The bytes from positions `b.position()` through `b.position() + b.limit() -1` should have the format of a valid class file as defined by The Java Virtual Machine Specification.
      `cs` - the associated CodeSource, or `null` if none
    Returns:
      the `Class` object created from the data, and optional CodeSource.
    Throws:
      `ClassFormatError` - if the data did not contain a valid class
      `SecurityException` - if an attempt is made to add this class to a package that contains classes that were signed by a different set of certificates than this class, or if the class name begins with "java.".
    Since:
      1.5

  - ### getPermissions

    protected PermissionCollection getPermissions(CodeSource codesource)
    Returns the permissions for the given CodeSource object.

    This method is invoked by the defineClass method which takes a CodeSource as an argument when it is constructing the ProtectionDomain for the class being defined.

    Parameters:
      `codesource` - the codesource.
    Returns:
      the permissions granted to the codesource.