Can you find out what packages a class has imported?

Question

Hi all, I start my final year at uni in september and at the moment i'm just experimenting with stuff while i try and decide what to do for my final year project.
Without going into too much detail what i want to be able to do is for the client to "submit" a class file that is then dynamically loaded and run on the server. Obviously this has security implications so what i was wondering was if it is possible to determine what packages a class has imported from the actual classfile.
I've looked through the vm spec but haven't been able to find anything theyre that looks like it'll help. Any suggestions or ideas (or solutions!) would be much appreciated.
Thanks. Matt.

Answer 1

You could use the Class.getDeclaredClasses() to see the class types that exist as members, but that won't do you any good since the class will have already undergone static initialization within your VM, and the security breach would have already been made. You could inspect the constant pool in the class data to check what other classes are referenced but then that brings up several questions:
1 - How do you know which classes are bad? Even if you define a set, copies can be created in new packages (or simply aliased) so that the list is invalid.
2 - How do you know the class you are loading is not malicious? A client class may not reference any external class but may be malicious itself.
3 - The offending class might use reflection exclusively to reference classes without leaving a trace in the class file. This would be absolutely impossible to detect.
Your only choices are (a) to use signed classes, and make it the responsibility of someone to review the classes and sign them, or (b) install your own Security Manager to catch all prohibited activity, or (c) check as classes are referenced in the classloader. Option (a) is the best method, but (b) or (c) might work in a very restricted environment.