知识库--WebappClassLoader（47）

The WebappClassLoader Class

The org.apache.catalina.loader.WebappClassLoader class represents the class loader reponsible for loading the classes used in a web application. WebappClassLoader extends the java.net.URLClassLoader class, the class we used for loading Java classes .

WebappClassLoader was designed for optimization and security in mind. For example, it caches the previously loaded classes to enhance performance. It also caches the names of classes it has failed to find, so that the next time the same classes are requested to be loaded, the class loader can throw the ClassNotFoundException without first trying to find them. WebappClassLoader searches for classes in the list of repositores as well as the specified JAR files.

With regard of security, the WebappClassLoader will not allow certain classes to be loaded. These classes are stored in a String array triggers and currently has one member:

private static final  String[] triggers = {"javax.servlet.Servlet"}

Also, you are not allowed to load classes belonging to these packages and subpackages under them, without first delegating to the system class loader:

private  static final String[] packageTriggers={
"javax",
"org.xml.sax",
"org.w3c.dom",
"org.apache.xerces",
"org.apache.xalan"
};

Caching

For better performance, classes that are loaded are cached so that the next time a class is required, it can be taken from the cache. Caching can be done locally, meaning that the cache is managed by the WebappClassLoader instance. In addition,* the java.lang.ClassLoader maintains a Vector of previously loaded classes to prevent those classes from being garbage-collected*. In this case, caching is managed by the super class.//超类管理缓存

Each class that may be loaded by WebappClassLoader is referred to as a resource. A resource is represented by the org.apache.catalina.loader.ResourceEntry class. A ResourceEntry instance holds the byte array representation of the class, the last modified date, the Manifest(if the resource if from a JAR file), etc.

public class ResourceEntry{
public long lastModified = -1;
public byte[] binaryContent = null;
public Class loadedClass = null;
//URL source from where the oject was loaded
public URL source = null;
public URL CodeBase = null;
public Manifest manifest = null;
public Certificate[] certificates = null;
}

All cached resources are stored in a HashMap called resourceEntries.

All resources that were not found are stored in another HashMap called notFoundResources.

When loading a class, the WebappClassLoader class applies these rules:

1 All previously loaded classes are cached, so first check the local cache.
2 If not found in the local cache,check in the cache,i.e. by calling the findLoadedClass of the  java.lang.ClassLoader class.
3 If not found in both caches, use the system's class loader to prevent the web application from overriding J2EE class.
4 If SecurityManager is used, check if the class is allowed to be loaded.If not,throw a ClassNotFoundException.
5 If the dalagate flag is on or if the class to be loaded belongs to the package name in the package trigger, use the parent class loader to load the class. If the parent  class loader is null, use the system class loader.
6 Load the class from the  current  repositories.
7 If the class is not found in the  current repositories, and if the delegate flag is not on, use the parent class loader. If the parent class loader is null,use the system class loader.
8 If the class is still not found, throw a ClassNotFoundException.