BackgroundOne of the advantages of decoupled components in systems is that you can extend the system without having to touch the existing code.Sometimes you don't even have to recompile the old code because you can dynamically load classes from disk like this:clazz = Demo.class.getClassLoader().loadClass(full.package.name.to.SomeClass);That allows for a kind of plug-in architecture of sorts (give or take).QuestionHow do you prevent malicious code from running when dynamically loading a class from disk using ClassLoader ?
Avoid malicious code while dynamically loading classes with ClassLoader
java;security;class;malicious code;plugin architecture
This question is a duplication of this one on Stack Overflow.That being said, plugin architecture does not sound like something where you can meaningfully defend against malicious code, as it will need to interact closely with the rest of the system. That's a game you can't win, so don't play it. Simply accept that plugins can do whatever they want in your system, so only trusted plugins should be installed.