SecureClassLoader (Java SE 26 & JDK 26)
Description: declaration: module: java.base, package: java.security, class: SecureClassLoader
Keywords: java.security.SecureClassLoader class

# Class SecureClassLoader

java.lang.Object
java.lang.ClassLoader
java.security.SecureClassLoader

Direct Known Subclasses:
  `URLClassLoader`

public class SecureClassLoader extends ClassLoader
This class extends `ClassLoader` with additional support for defining classes with an associated code source and permissions.

API Note:
  Permissions cannot be used for controlling access to resources as the Security Manager is no longer supported.
Since:
  1.2

- ## Constructor Summary

  Constructors
  Modifier
  Constructor
  Description
  `protected`
  `SecureClassLoader()`
  Creates a new `SecureClassLoader` using the system class loader as the parent.
  `protected`
  `SecureClassLoader(ClassLoader parent)`
  Creates a new `SecureClassLoader` using the specified parent class loader for delegation.
  `protected`
  `SecureClassLoader(String name, ClassLoader parent)`
  Creates a new `SecureClassLoader` of the specified name and using the specified parent class loader for delegation.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `protected final Class<?>`
  `defineClass(String name, byte[] b, int off, int len, CodeSource cs)`
  Converts an array of bytes into an instance of class `Class`, with an optional CodeSource.
  `protected final Class<?>`
  `defineClass(String name, ByteBuffer b, CodeSource cs)`
  Converts a `ByteBuffer` into an instance of class `Class`, with an optional CodeSource.
  `protected PermissionCollection`
  `getPermissions(CodeSource codesource)`
  Returns the permissions for the given CodeSource object.

  ### Methods declared in class ClassLoader

  `clearAssertionStatus, defineClass, defineClass, defineClass, defineClass, definePackage, findClass, findClass, findLibrary, findLoadedClass, findResource, findResource, findResources, findSystemClass, getClassLoadingLock, getDefinedPackage, getDefinedPackages, getName, getPackage, getPackages, getParent, getPlatformClassLoader, getResource, getResourceAsStream, getResources, getSystemClassLoader, getSystemResource, getSystemResourceAsStream, getSystemResources, getUnnamedModule, isRegisteredAsParallelCapable, loadClass, loadClass, registerAsParallelCapable, resolveClass, resources, setClassAssertionStatus, setDefaultAssertionStatus, setPackageAssertionStatus, setSigners`
  Modifier and Type
  Method
  Description
  `void`
  `clearAssertionStatus()`
  Sets the default assertion status for this class loader to `false` and discards any package defaults or class assertion status settings associated with the class loader.
  `protected final Class<?>`
  `defineClass(byte[] b, int off, int len)`
  Deprecated.
  Replaced by `defineClass(String, byte[], int, int)`
  `protected final Class<?>`
  `defineClass(String name, byte[] b, int off, int len)`
  Converts an array of bytes into an instance of class `Class`.
  `protected final Class<?>`
  `defineClass(String name, byte[] b, int off, int len, ProtectionDomain protectionDomain)`
  Converts an array of bytes into an instance of class `Class`, with a given `ProtectionDomain`.
  `protected final Class<?>`
  `defineClass(String name, ByteBuffer b, ProtectionDomain protectionDomain)`
  Converts a `ByteBuffer` into an instance of class `Class`, with the given `ProtectionDomain`.
  `protected Package`
  `definePackage(String name, String specTitle, String specVersion, String specVendor, String implTitle, String implVersion, String implVendor, URL sealBase)`
  Defines a package by name in this `ClassLoader`.
  `protected Class<?>`
  `findClass(String name)`
  Finds the class with the specified binary name.
  `protected Class<?>`
  `findClass(String moduleName, String name)`
  Finds the class with the given binary name in a module defined to this class loader.
  `protected String`
  `findLibrary(String libname)`
  Returns the absolute path name of a native library.
  `protected final Class<?>`
  `findLoadedClass(String name)`
  Returns the class with the given binary name if this loader has been recorded by the Java virtual machine as an initiating loader of a class with that binary name.
  `protected URL`
  `findResource(String name)`
  Finds the resource with the given name.
  `protected URL`
  `findResource(String moduleName, String name)`
  Returns a URL to a resource in a module defined to this class loader.
  `protected Enumeration<URL>`
  `findResources(String name)`
  Returns an enumeration of `URL` objects representing all the resources with the given name.
  `protected final Class<?>`
  `findSystemClass(String name)`
  Finds a class with the specified binary name, loading it if necessary.
  `protected Object`
  `getClassLoadingLock(String className)`
  Returns the lock object for class loading operations.
  `final Package`
  `getDefinedPackage(String name)`
  Returns a `Package` of the given name that has been defined by this class loader.
  `final Package[]`
  `getDefinedPackages()`
  Returns all of the `Package`s that have been defined by this class loader.
  `String`
  `getName()`
  Returns the name of this class loader or `null` if this class loader is not named.
  `protected Package`
  `getPackage(String name)`
  Deprecated.
  If multiple class loaders delegate to each other and define classes with the same package name, and one such loader relies on the lookup behavior of `getPackage` to return a `Package` from a parent loader, then the properties exposed by the `Package` may not be as expected in the rest of the program.
  `protected Package[]`
  `getPackages()`
  Returns all of the `Package`s that have been defined by this class loader and its ancestors.
  `final ClassLoader`
  `getParent()`
  Returns the parent class loader for delegation.
  `static ClassLoader`
  `getPlatformClassLoader()`
  Returns the platform class loader.
  `URL`
  `getResource(String name)`
  Finds the resource with the given name.
  `InputStream`
  `getResourceAsStream(String name)`
  Returns an input stream for reading the specified resource.
  `Enumeration<URL>`
  `getResources(String name)`
  Finds all the resources with the given name.
  `static ClassLoader`
  `getSystemClassLoader()`
  Returns the system class loader.
  `static URL`
  `getSystemResource(String name)`
  Find a resource of the specified name from the search path used to load classes.
  `static InputStream`
  `getSystemResourceAsStream(String name)`
  Open for reading, a resource of the specified name from the search path used to load classes.
  `static Enumeration<URL>`
  `getSystemResources(String name)`
  Finds all resources of the specified name from the search path used to load classes.
  `final Module`
  `getUnnamedModule()`
  Returns the unnamed `Module` for this class loader.
  `final boolean`
  `isRegisteredAsParallelCapable()`
  Returns `true` if this class loader is registered as parallel capable, otherwise `false`.
  `Class<?>`
  `loadClass(String name)`
  Loads the class with the specified binary name.
  `protected Class<?>`
  `loadClass(String name, boolean resolve)`
  Loads the class with the specified binary name.
  `protected static boolean`
  `registerAsParallelCapable()`
  Registers the caller as parallel capable.
  `protected final void`
  `resolveClass(Class<?> c)`
  Links the specified class.
  `Stream<URL>`
  `resources(String name)`
  Returns a stream whose elements are the URLs of all the resources with the given name.
  `void`
  `setClassAssertionStatus(String className, boolean enabled)`
  Sets the desired assertion status for the named top-level class in this class loader and any nested classes contained therein.
  `void`
  `setDefaultAssertionStatus(boolean enabled)`
  Sets the default assertion status for this class loader.
  `void`
  `setPackageAssertionStatus(String packageName, boolean enabled)`
  Sets the package default assertion status for the named package.
  `protected final void`
  `setSigners(Class<?> c, Object[] signers)`
  Sets the signers of a class.

  ### Methods declared in class Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`
  Modifier and Type
  Method
  Description
  `protected Object`
  `clone()`
  Creates and returns a copy of this object.
  `boolean`
  `equals(Object obj)`
  Indicates whether some other object is "equal to" this one.
  `protected void`
  `finalize()`
  Deprecated, for removal: This API element is subject to removal in a future version.
  Finalization is deprecated and subject to removal in a future release.
  `final Class<?>`
  `getClass()`
  Returns the runtime class of this `Object`.
  `int`
  `hashCode()`
  Returns a hash code value for this object.
  `final void`
  `notify()`
  Wakes up a single thread that is waiting on this object's monitor.
  `final void`
  `notifyAll()`
  Wakes up all threads that are waiting on this object's monitor.
  `String`
  `toString()`
  Returns a string representation of the object.
  `final void`
  `wait()`
  Causes the current thread to wait until it is awakened, typically by being notified or interrupted.
  `final void`
  `wait(long timeoutMillis)`
  Causes the current thread to wait until it is awakened, typically by being notified or interrupted, or until a certain amount of real time has elapsed.
  `final void`
  `wait(long timeoutMillis, int nanos)`
  Causes the current thread to wait until it is awakened, typically by being notified or interrupted, or until a certain amount of real time has elapsed.

- ## Constructor Details

  - ### SecureClassLoader

    protected SecureClassLoader(ClassLoader parent)
    Creates a new `SecureClassLoader` using the specified parent class loader for delegation.
    API Note:
      If `parent` is specified as `null` (for the bootstrap class loader) then there is no guarantee that all platform classes are visible. See Run-time Built-in Class Loaders for information on the bootstrap class loader and other built-in class loaders.
    Parameters:
      `parent` - the parent ClassLoader, can be `null` for the bootstrap class loader

  - ### SecureClassLoader

    protected SecureClassLoader()
    Creates a new `SecureClassLoader` using the system class loader as the parent.

  - ### SecureClassLoader

    protected SecureClassLoader(String name, ClassLoader parent)
    Creates a new `SecureClassLoader` of the specified name and using the specified parent class loader for delegation.
    API Note:
      If `parent` is specified as `null` (for the bootstrap class loader) then there is no guarantee that all platform classes are visible. See Run-time Built-in Class Loaders for information on the bootstrap class loader and other built-in class loaders.
    Parameters:
      `name` - class loader name; or `null` if not named
      `parent` - the parent class loader, can be `null` for the bootstrap class loader
    Throws:
      `IllegalArgumentException` - if the given name is empty.
    Since:
      9

- ## Method Details

  - ### defineClass

    protected final Class<?> defineClass(String name, byte[] b, int off, int len, CodeSource cs)
    Converts an array of bytes into an instance of class `Class`, with an optional CodeSource. Before the class can be used it must be resolved.

    If a non-null CodeSource is supplied a ProtectionDomain is constructed and associated with the class being defined.

    Parameters:
      `name` - the expected name of the class, or `null` if not known, using '.' and not '/' as the separator and without a trailing ".class" suffix.
      `b` - the bytes that make up the class data. The bytes in positions `off` through `off+len-1` should have the format of a valid class file as defined by The Java Virtual Machine Specification.
      `off` - the start offset in `b` of the class data
      `len` - the length of the class data
      `cs` - the associated CodeSource, or `null` if none
    Returns:
      the `Class` object created from the data, and optional CodeSource.
    Throws:
      `ClassFormatError` - if the data did not contain a valid class
      `IndexOutOfBoundsException` - if either `off` or `len` is negative, or if `off+len` is greater than `b.length`.
      `SecurityException` - if an attempt is made to add this class to a package that contains classes that were signed by a different set of certificates than this class, or if the class name begins with "java.".

  - ### defineClass

    protected final Class<?> defineClass(String name, ByteBuffer b, CodeSource cs)
    Converts a `ByteBuffer` into an instance of class `Class`, with an optional CodeSource. Before the class can be used it must be resolved.

    If a non-null CodeSource is supplied a ProtectionDomain is constructed and associated with the class being defined.

    Parameters:
      `name` - the expected name of the class, or `null` if not known, using '.' and not '/' as the separator and without a trailing ".class" suffix.
      `b` - the bytes that make up the class data. The bytes from positions `b.position()` through `b.position() + b.limit() -1` should have the format of a valid class file as defined by The Java Virtual Machine Specification.
      `cs` - the associated CodeSource, or `null` if none
    Returns:
      the `Class` object created from the data, and optional CodeSource.
    Throws:
      `ClassFormatError` - if the data did not contain a valid class
      `SecurityException` - if an attempt is made to add this class to a package that contains classes that were signed by a different set of certificates than this class, or if the class name begins with "java.".
    Since:
      1.5

  - ### getPermissions

    protected PermissionCollection getPermissions(CodeSource codesource)
    Returns the permissions for the given CodeSource object.

    This method is invoked by the defineClass method which takes a CodeSource as an argument when it is constructing the ProtectionDomain for the class being defined.

    Parameters:
      `codesource` - the codesource.
    Returns:
      the permissions for the codesource.