When a custom class loader must override the getPermissions() method, the implementation must consult the default system policy by explicitly invoking the superclass's getPermissions() method before assigning arbitrary permissions to the code source. The getPermissions() method is defined by SecureClassLoader, which extends ClassLoader. ClassLoader is abstract and must not be extended directly.A custom class loader that ignores the superclass's getPermissions() could load untrusted classes with elevated privileges.
Noncompliant Code Example
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6ddaeaf918236812-4c61064a-47114a90-af0599c6-21571cc42166c678ced3f849"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] | [Class ClassLoader | http://java.sun.com/javase/6/docs/api/java/lang/ClassLoader.html] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="17eee6945090d572-19228825-4ed345ee-9eefba8d-0de3f02caf6520991bf32eca"><ac:plain-text-body><![CDATA[ | [[Oaks 2001 | AA. Bibliography#Oaks 01]] |
| ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="595ae472e6e2285a-142dd888-459a411a-88d4a52e-fb8004d214b8af8056c82b12"><ac:plain-text-body><![CDATA[ | [[Security 2006 | AA. Bibliography#Security 06]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
...