Java安全性：通过URLClassLoader加载的沙盒插件

从文档：

The AccessControlContext of the thread that created the instance ofURLClassLoader will be used when subsequently loading classes and resources.

The classes that are loaded are by default granted permission only to accessthe URLs specified when the URLClassLoader was created.

URLClassLoader完全按照其说的做，AccessControlContext是您需要查看的内容。基本上，在AccessControlContext中引用的线程没有权限执行您认为做的事情。