Java security problem

[DeMarcus]

Hi,

I want to do a simple plugin interface so programmers
can easily write their own plugins to my software.
However, when I use URLClassLoader to load a class
that shall represent the plugin it seems that there
are a lot of security constraints that makes the
plugin limited.

For instance I can't have inner classes in the plugin,
because that gives me an IllegalAccessError. I tried
to avoid that by calling the methods of the plugins
with means of doPrivileged(), but it didn't help.

How can I be back to normal programming again despite
I'm using URLClassLoader?

Thanks
Daniel

 

[Guest]

Hi,

I want to do a simple plugin interface so programmers can easily write
their own plugins to my software. However, when I use URLClassLoader to
load a class that shall represent the plugin it seems that there are a lot
of security constraints that makes the plugin limited.

Most plugins are defined by a certain Interface or extend an abstract
class. It is convenient to place all plugins within a specific directory
(often referenced by a property). You must also somehow tell your program
which plugin(s) to load using a ClassLoader which knows where to look.

Class clazz = Class.forName("com.mycompany.MyPlugin", true, loader);
Plugin plugin = (Plugin) clazz.newInstance();

From there, only access the methods defined in your Plugin interface.

HTH,
La'ie Techie

 

[DeMarcus]

Most plugins are defined by a certain Interface or extend an abstract
class. It is convenient to place all plugins within a specific directory
(often referenced by a property). You must also somehow tell your program
which plugin(s) to load using a ClassLoader which knows where to look.

Class clazz = Class.forName("com.mycompany.MyPlugin", true, loader);
Plugin plugin = (Plugin) clazz.newInstance();

From there, only access the methods defined in your Plugin interface.

HTH,
La'ie Techie

Actually I'm doing exactly as you propose, but instead of
Class.forName() I use clazz = loader.findClass( "MyPlugin" )
where loader is a URLClassLoader.

Is there a difference in Class.forName() and loader.findClass()?