| Wiki Markup |
|---|
When an API (see table below) is invoked on a {{Class}} object, a comparison is run between the immediate caller's class loader and that of the {{Class}} object. The {{Class}} object is the object on which an API is invoked. According to \[[JLS 05|AA. Java References#JLS 05]\]: |
The method getClass returns the Class object that represents the class of the object
...
.
APIs capable of bypassing SecurityManager's checks |
|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
Security manager checks may get bypassed depending on the immediate caller's class loader.
For instance, in the presence of a security manager, the getSystemClassLoader and getParent methods succeed only if the caller's class loader is the delegation ancestor of the current class loader or if the caller's class loader is the same as the current one or if the code in the current execution context has the RunTimePermission, namely "getClassLoader".
Noncompliant Code Example
The createInstance method is the immediate caller of java.lang.Class.newInstance in this noncompliant example. The newInstance method is being invoked on the dateClass class Class object. The issue is that the untrustedCode method can trigger the instantiation of a new class even though it should not have the permission to do so. This behavior is not caught by the security manager.
...