Steps 7−8: Define the class, verify it, and resolve it

The appletviewer and Java Plug−in define their own class loader, which is an extension of the URL class loader. This class loader extends to classes loaded from a file URL the permissions to open a connection to and accept a connection from the localhost. Classes loaded from an HTTP URL have the same permissions as those granted in the URL class loader. The only other publicly−accessible class loader in the core API is the RMI class loader. There is a class called RMIClassLoader java.rmi.server.RMIClassLoader which, despite its name, is neither a class loader nor restricted to RMI. This class has a static method called loadClass which, like the loadClass method of the ClassLoader class, finds the named class and defines it. It uses an internal class loader to do this; the internal class loader happens to be a modification of the URLClassLoader class. The URL used by this class loader is specified by the java.rmi.server.codebase property; it uses the same permissions as a standard URL class loader. If the features of this class loader meet your requirements, you can use it in any program, regardless of whether your program uses RMI.

6.4 Miscellaneous Class Loading Topics

There are a few details about class loaders that we havent yet covered. These details are not directly related to the security aspects of the class loader, which is why weve saved them until now. If youre interested in the complete details of the class loader, well fill in the last few topics here.

6.4.1 Delegation

As weve mentioned, class loading follows a delegation model. This model permits a class loader to be instantiated with this constructor: protected ClassLoaderClassLoader parent Create a class loader that is associated with the given class loader. This class loader delegates all operations to the parent first: if the parent is able to fulfill the operation, this class loader takes no action. For example, when the class loader is asked to load a class via the loadClass method, it first calls the loadClass method of the parent. If that succeeds, the class returned by the delegate will ultimately be returned by this class. If that fails, the class loader then uses its original logic to complete its task, something like this: public Class loadClassString name { Class cl; cl = delegate.loadClassname; if cl = null return cl; else continue with the loadClass logic } You may retrieve the delegate associated with a class loader with the following method. public final ClassLoader getParent Return the class loader to which operations are being delegated. The class loader that exists at the root of the class loader hierarchy is retrieved via this method: public static ClassLoader getSystemClassLoader 110