Re: Issue with BuiltinClassLoader.ucp field not being visible
On Tue, Aug 10, 2021 at 12:51 AM Luke Hutchison <luke.hutch@gmail.com> wrote:
Could a getURLClassPath() method please be added to BuiltInClassLoader?
For security reasons, the getURLClassPath() method should return a copy of ucp, not the reference to ucp, to prevent the caller from modifying the system classpath.
On 10/08/2021 07:58, Luke Hutchison wrote:
On Tue, Aug 10, 2021 at 12:51 AM Luke Hutchison <luke.hutch@gmail.com> wrote:
Could a getURLClassPath() method please be added to BuiltInClassLoader?
For security reasons, the getURLClassPath() method should return a copy of ucp, not the reference to ucp, to prevent the caller from modifying the system classpath. I think you need more context here. This a JDK internal class so shouldn't be used directly. It reads like the original message was looking for the value of java.class.path as a sequence of URLs, is that right?
-Alan
The issue is that the Instrumentation.appendToSystemClassLoaderSearch method "does not change the value of java.class.path system property" (stated in the JavaDoc): https://docs.oracle.com/en/java/javase/16/docs/api/java.instrument/java/lang...) but classpath entries that are added to the end of the system classloader classpath in this way are also not recorded anywhere else that is readable by user code. Without a method for reading these manual additions to BaseClassLoader.ucp, there is simply no way to determine what if any jars or directories have been added to the classpath using this mechanism. What I'm asking for is some public API mechanism to determine what additional classpath elements have been added to the end of the system classloader path via the Instrumentation.appendToSystemClassLoaderSearch method, so that classpath scanners can also work in the Java agent context, if this method has been called to augment the classpath. Maybe that should be part of the Instrumentation class, so that it is only accessible to Java agent code that is able to get a reference to an Instrumentation object. On Tue, Aug 10, 2021 at 1:16 AM Alan Bateman <Alan.Bateman@oracle.com> wrote:
On 10/08/2021 07:58, Luke Hutchison wrote:
On Tue, Aug 10, 2021 at 12:51 AM Luke Hutchison <luke.hutch@gmail.com> wrote:
Could a getURLClassPath() method please be added to BuiltInClassLoader?
For security reasons, the getURLClassPath() method should return a copy of ucp, not the reference to ucp, to prevent the caller from modifying the system classpath. I think you need more context here. This a JDK internal class so shouldn't be used directly. It reads like the original message was looking for the value of java.class.path as a sequence of URLs, is that right?
-Alan
On Tue, Aug 10, 2021 at 1:34 AM Luke Hutchison <luke.hutch@gmail.com> wrote:
Maybe that should be part of the Instrumentation class, so that it is only accessible to Java agent code that is able to get a reference to an Instrumentation object.
Actually I take that last part back, that would not be very helpful to libraries like ClassGraph. It would be much better if there were simply a public method in `AppClassLoader` that could be used to get all classpath elements that have been added for instrumentation.
participants (2)
-
Alan Bateman
-
Luke Hutchison