Classes in class path are trusted?

Question

The goal I am trying to achieve is to separate classes into two groups (untrusted and trusted) by using different class loaders to load them. All classes that are untrusted will be loaded using a CustomClassLoader. All classes that are trusted are expected to be loaded using the application / system class loader. However, the problem that I seem to be facing is that if a class is in a class path, then it will automatically be loaded by the system class loader, which automatically puts it in the trusted category.
Suppose on the hard drive is the following:
c:\asdf\A.class
c:\asdf\B.class
Suppose the code for A.class is:
public class A {
       public void doSomething() {
                B b = new B();
                b.doSomething();
}Suppose the code for B.class is:
public class B {
        public void doSomething() {
                 File f = new File("c:\\autoexec.bat");
                 f.delete();
}Also, suppose the classpath consists of the path c:\asdf;
And suppose there is a custom class loader that accepts a file, and returns a class:
public class CustomClassLoader extends ClassLoader {
         public Class createClass(File f) {
                   // calls define class
         public Class loadClass(String name, boolean resolveIt) throws ClassNotFoundException {
                  System.out.println("CustomClassLoader.loadClass(" + name + ", " + resolveIt + ")");
                  return super.loadClass(name, resolveIt);
}Now, suppose the following code:
CustomClassLoader cc = new CustomClassLoader();
Class c = cc.createClass(new File("c:\\asdf\\A.class"));
A a = (A) c.newInstance();
a.doSomething();The CustomClassLoader is used to load class A. However, since class B is used by class A, and class B is in the class path, the application/system class loader will be used to load class B, unless the CustomClassLoader explicitly loads class B as well.
But, in the following article: http://www.javaworld.com/javaworld/jw-10-1996/jw-10-indepth.html
the author says the findSystemClass(String name) method must be called, after the local cache has been checked, in order to guarantee the security of the system. Can somebody explain why this is true?
What I would like to do is to determine if the system class loader has already loaded / defined a class. If not, then I could search the class paths and load that class using the CustomClassLoader. However, there doesn't seem to be a way to check to see if a class has been loaded. There is a findClass(String name) method, but it is protected, so I can't do something like: ClassLoader.getSystemClassLoader().findClass(name).

Answer 1

java.xxx classes are always loaded by the boot
classloader.Actually they do not need to be. Your custom classloader can break the classloader delegation chain
if it wishes in which case the default classloader will not load the java and javax classes. your custom
loader would then have to load them.
However this is not advisable as it allows your untrusted code to use its own version of, for example,
Object. This can cause security problems. It could be possible for the untrusted code to create its
own version of FileInputStream which does not perform Security checks (and therefore exists outside of
the sandbox) A great deal of casre needs to be taken if you plan on following this approach.
In general it is best to put untrusted code into a path that is not in your classpath. Everything works (mostly)
as you would expect in this case.
matfud