public class SecureDexClassLoader extends Object
DexClassLoader
provided by the Android system and it is used to load classes
from jar and apk container files including a classes.dex entry in a secure way.
In order to instantiate this class a call to
SecureLoaderFactory.createDexClassLoader(String, String, ClassLoader, Map)
must be performed.
SecureDexClassLoader ensures integrity of loaded external remote
classes by comparing them with the developer certificate, which
is retrieved either by a provided associative map between package names
and certificate remote URL or by simply reverting the
first two words of the package name of the loaded class and then
by adding each following word in the same order and separated by
a slash "/".
Package name reversion example:
Class name = it.necst.grabnrun.example.TestClassImpl
Constructed URL = https://necst.it/grabnrun/example
Final certificate location = https://necst.it/grabnrun/example/certificate.pem
A request is pointed to the final certificate location and if the file is found, it is imported in the local private application directory.
Please note that in the current implementation certificates obtained
by reverting package name must have been saved at the described
location as "certificate.pem". Moreover all the certificates must
fit requirements of a standard X509Certificate,
they must be valid in the current time frame and of course they must have been
used to sign the jar or apk, which contains the classes to be loaded.
If any of these previous requirements is violated no class is loaded and this class returns without executing any class loading operation.
| Modifier and Type | Method and Description |
|---|---|
Class<?> |
loadClass(String className) |
void |
wipeOutPrivateAppCachedData(boolean containerPrivateFolder,
boolean certificatePrivateFolder)
Sometimes it may be useful to remove those data that have been cached in
the private application folders (basically for performance reason or for making
SecureDexClassLoader works also partially offline). |
public Class<?> loadClass(String className) throws ClassNotFoundException
className - the full class name to load. It must fit the form "package name + . + class name".
A valid full class name is for example "it.polimi.myapplication.classA"; while "classA" is not
enough since it misses the package name and so SecureDexClassLoader will not find any
class to load.null pointer in case that at least one of the security
constraints for secure dynamic class loading is violated.ClassNotFoundException - this exception is raised whenever no security constraint is violated but still the target class is
not found in any of the available containers used to instantiate this SecureDexClassLoader object.ClassLoader.loadClass(java.lang.String)public void wipeOutPrivateAppCachedData(boolean containerPrivateFolder,
boolean certificatePrivateFolder)
SecureDexClassLoader works also partially offline). A call to this method solves the issue.
Please notice that a call to this method with both the parameters set to false has no effect.
In any of the other cases the content of the related folder(s) will be erased and
since some of the data may have been used by SecureDexClassLoader instances, it is
required to the caller to create a new SecureDexClassLoader object through
SecureLoaderFactory since the already present object is going to be disabled
from loading classes dynamically.
containerPrivateFolder - if the private folder where jar and apk containers downloaded from remote URL or imported from local storage needs to be wiped out.certificatePrivateFolder - if the private folder containing certificates needs to be wiped out.