...
The trusted code's class loader allows these methods to be invoked, however, although an untrusted code's class loader may lack these privileges. When However, when the untrusted code's class loader delegates to the trusted code's class loader, the untrusted code has visibility to the trusted code according to the declared visibility of the trusted code. In the absence of such a delegation relationship, the class loaders would ensure namespace separation; consequently, the untrusted code would be unable to observe members or to invoke methods belonging to the trusted code. Such a
A problem arises because the class loader delegation model is imperative to many Java implementations and frameworks so . So the best advice is to avoid exposing these the methods listed above to untrusted code.
Consider, for example, an attack scenario where untrusted code is attempting to load a privileged class. If its class loader is permitted to delegate the class loading to a trusted class's class loader, then privilege escalation can occur, because the untrusted code's class loader may lack permission to load the requested privileged class on its own. Furthermore, if the trusted code accepts tainted inputs, the trusted code's class loader could load additional privileged — or even malicious — classes on behalf of the untrusted code.
...