Page History

...

Always assign appropriate permissions to code. When more control is required over the granularity of permissions, define custom permissions. (SEC08-J. Define custom security permissions for fine grained security)

Noncompliant Code Example

This noncompliant example shows an overridden getPermissions() method, defined in a custom class loader. It grants java.security.AllPermission to any class that it loads. This example also violates SEC10-J. Call the superclass's getPermissions method when writing a custom class loader.

protected PermissionCollection getPermissions(CodeSource cs) {
  PermissionCollection pc = new Permissions();
  pc.add(new java.security.AllPermission());   // permission to create a class loader
  // other permissions
  return pc;
}

Compliant Solution

This compliant solution does not grant the java.security.AllPermission to any class it loads.

protected PermissionCollection getPermissions(CodeSource cs) {
  PermissionCollection pc = super.getPermissions(cs);
  // other permissions
  return pc;
}

Exceptions

SEC31-EX1: It may be necessary to grant AllPermission to trusted library code so that callbacks will work. For example, it is a common practice to grant AllPermission to the optional Java system code packages:

...