| Wiki Markup |
|---|
When an API (seeone of the mthods from the table below) is invoked on a {{Class}} object, a comparison is run between the immediate caller's class loader and that of the {{Class}} object. The {{Class}} object isAccording to the objectJava on which an API is invoked. According toLanguage Specification \[[JLS 05|AA. Java References#JLS 05]\]: |
...
section 4.3.2 "The Class Object": "The method {{getClass}} returns the {{Class}} object that represents the class of the object". |
APIs capable of bypassing SecurityManager's checks |
|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
Security manager checks may get bypassed depending on the immediate caller's class loader.
For instance, in the presence of a security manager, the getSystemClassLoader and getParent methods succeed only if the caller's class loader is the delegation ancestor of the current class loader or if the caller's class loader is the same as the current one or if the code in the current execution context has the RunTimePermission, namely "getClassLoader".
...
Note that the Class.newInstance()} method requires the class to contain a no-argument constructor. If this requirement is not satisfied, a runtime exception results, which indirectly prevents a security breach.
...