title: ClassNotFoundException issued by URLClassLoader when the Security Manager is enabled
body: <p>For an experimental project, I am trying to load a class with URLClassLoader with the security manager enabled. Despite the fact that the URL and that the class do exist, the code always fails with a ClassNotFoundException.</p>
  
  <p>This behaviour has been observed with at least the following versions of java (the ones available on my system, a MacOSX Mojave 10.14.6; not tested yet on Windows or Linux or with other Java implementations):</p>
  
  <p>java version "1.8.0_181"
  Java(TM) SE Runtime Environment (build 1.8.0_181-b13)
  Java HotSpot(TM) 64-Bit Server VM (build 25.181-b13, mixed mode)</p>
  
  <p>java version "10.0.2" 2018-07-17
  Java(TM) SE Runtime Environment 18.3 (build 10.0.2+13)
  Java HotSpot(TM) 64-Bit Server VM 18.3 (build 10.0.2+13, mixed mode)</p>
  
  <p>java version "12.0.1" 2019-04-16
  Java(TM) SE Runtime Environment (build 12.0.1+12)
  Java HotSpot(TM) 64-Bit Server VM (build 12.0.1+12, mixed mode, sharing)</p>
  
  <p>After hours of troubleshooting (checking the paths, looking for invisible characters in the paths, reading the docs on class loaders, etc), I realized that <strong><em>the exception occurs ONLY when the security manager is enabled</em></strong>. When I disable it, the class is found without problem. I would have expected some kind of security exception, but not a ClassNotFoundException.</p>
  
  <p>Obviously, the absence of a security manager severely limits the usefulness of a class loader (especially if one wants to load untrusted, signed classes and jars). The permission for creating a class loader is obviously granted in the security policy.</p>
  
  <p>The code below is the minimal needed for reproducing the problem.</p>
  
  <p>I am relatively new to Java. I may be doing something stupid. Has anyone observed this behaviour before? Is it on purpose? Am I missing anything?</p>
  
  <p>Thanks for any help.</p>
  
  <pre class="lang-sh prettyprint-override"><code>.
  ├── ClassLoaderTest.class
  ├── ClassLoaderTest.java
  ├── Makefile
  ├── security.policy
  └── untrusted
      ├── Makefile
      ├── Untrusted.class
      └── Untrusted.java
  
  1 directory, 7 files
  </code></pre>
  
  <pre class="lang-java prettyprint-override"><code>// ClassLoaderTest.java
  
  import java.net.URLClassLoader;
  import java.net.URL;
  
  public class ClassLoaderTest {
  
      public static void main(String[] args) throws Exception {
          URL[] urls = new URL[1];
          urls[0] = new URL("file:./untrusted/"); // untrusted/ could be anywhere; for the purpose of the test, it is in the working directory
          URLClassLoader loader = new URLClassLoader(urls);
          Class&lt;?&gt; cl = loader.loadClass("Untrusted"); // one tries to load: untrusted/Untrusted.class
          cl.getConstructor().newInstance(); // or cl.getDeclaredConstructor().newInstance()
          System.exit(0);
      }
  }
  </code></pre>
  
  <pre class="lang-java prettyprint-override"><code>public class Untrusted {
      public Untrusted() {
          System.out.println("Instantiation of Untrusted");
      }
  
      public static void main(String args[]) {
          Untrusted u = new Untrusted();
      }
  }
  </code></pre>
  
  <pre class="lang-sh prettyprint-override"><code>// security.policy
  // permissions granted to any code (no matter where it came from or whether it is signed)
  // THIS IS OBVIOUSLY FOR TESTING ONLY, only trusted sources should be granted a createClassLoader permission
  grant {
    permission java.lang.RuntimePermission "createClassLoader";
  };
  </code></pre>
  
  <p>Here is the outcome of the program:</p>
  
  <p><em>Without security manager: works</em></p>
  
  <pre class="lang-sh prettyprint-override"><code>$ java ClassLoaderTest
  Instantiation of Untrusted
  </code></pre>
  
  <p><em>With a security manager enabled: fails!</em></p>
  
  <pre class="lang-sh prettyprint-override"><code>$ java -Djava.security.manager -Djava.security.policy=security.policy ClassLoaderTest
  Exception in thread "main" java.lang.ClassNotFoundException: Untrusted
      at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:436)
      at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:588)
      at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
      at ClassLoaderTest.main(ClassLoaderTest.java:10)
  </code></pre>