Page History

When writing a custom class loader, sometimes it is desirable to override the getPermissions() method. In most cases, it is recommended that the implementation consult the default system policy before assigning arbitrary permissions to the code source. This can be automatically handled by explicitly invoking the superclass's getPermissions() method.

...

This noncompliant code example shows a snippet of a custom class loader that extends the class URLClassLoader. It overrides the getPermissions() method and does not call the superclass's more restrictive getPermissions() method. Note that URLClassLoader's getPermissions() method calls the Policy class's getPermissions() method which by default, uses the global system policy file to enforce access control. Consequently, a class defined using the custom class loader will have has permissions that are completely independent of those specified in the system-wide policy file and will in effect, the class's permissions override them.

protected PermissionCollection getPermissions(CodeSource cs) {
  PermissionCollection pc = new Permissions();
  pc.add(new RuntimePermission("exitVM"));   //allow exit from the VM anytime
  return pc;
}

...

In this compliant solution, as the overridden getPermissions() method calls super.getPermissions(), the default system-wide security policy is also consulted apart from in addition to the custom policy.

protected PermissionCollection getPermissions(CodeSource cs) {
  PermissionCollection pc = super.getPermissions(cs);
  pc.add(new RuntimePermission("exitVM"));
  return pc;
}

...