This ClassLoader provides a useful way to load untrusted Java code from a search path of arbitrary URLs, where each URL represents a directory or JAR file to search. Use the inherited loadClass( ) method to load a named class with a URLClassLoader. Classes loaded by a URLClassLoader have whatever permissions are granted to their java.security.CodeSource by the system java.security.Policy, plus they have one additional permission that allows the class loader to read any resource files associated with the class. If the class is loaded from a local file: URL that represents a directory, the class is given permission to read all files and directories below that directory. If the class is loaded from a local file: URL that represents a JAR file, the class is given permission to read that JAR file. If the class is loaded from a URL that represents a resource on another host, that class is given permission to connect to and accept network connections from that host. Note, however, that loaded classes are not granted this additional permission if the code that created the URLClassLoader in the first place would not have had that permission.

You can obtain a URLClassLoader by calling one of the URLClassLoader( ) constructors or one of the static newInstance( ) methods. If you call newInstance( ), the loadClass( ) method of the returned URLClassLoader performs an additional check to ensure that the caller has permission to access the specified package.

Figure 12-28. java.net.URLClassLoader

public class URLClassLoader extends java.security.SecureClassLoader {
// Public Constructors
     public URLClassLoader(URL[ ] urls);  
     public URLClassLoader(URL[ ] urls, ClassLoader parent);
     public URLClassLoader(URL[ ] urls, ClassLoader parent, 
     URLStreamHandlerFactory factory);  
// Public Class Methods
     public static URLClassLoader newInstance(URL[ ] urls);  
     public static URLClassLoader newInstance(URL[ ] urls, ClassLoader parent);  
// Public Instance Methods
     public URL[ ] getURLs( );  
// Protected Methods Overriding SecureClassLoader
     protected java.security.PermissionCollection getPermissions(java.security.
     CodeSource codesource);  
// Public Methods Overriding ClassLoader
     public URL findResource(String name);  
     public java.util.Enumeration<URL> findResources(String name) 
     throws java.io.IOException;  
// Protected Methods Overriding ClassLoader
     protected Class<?> findClass(String name) throws ClassNotFoundException;  
// Protected Instance Methods
     protected void addURL(URL url);  
     protected Package definePackage(String name, java.util.jar.Manifest man, 
     URL url) throws IllegalArgumentException;  
}