CODEWITHSUNDEEP
javasecurity
Igor
Igor

Reputation: 6245

How JVM works internally

ALL,

At work we have a software written in JAVA. It is operational and works fine. In couple of sources we have a statements like this:

import x.y.z

There is no source file where we use

import x.y.*

Recently we had a scan from the Software Assurance team and they found couple of deficiencies.

An example would be this:

The code is using MD5 encryption algorithm.

Our code does not even import a class connected to the MD5 let alone use it.

So, my question would be:

If I have an import for the class Foo, does JVM actually pulls everything from the JAR/library ?

Thank you.

Upvotes: 2

Views: 1218

Answers (2)

M J
M J

Reputation: 11

First, java compiler compiles the source code into byte code. At the run time,Java Virtual Machine (JVM) interprets this byte code and generates machine code which will be directly executed by the machine in which java program runs.

Visit good tutorial of JVM,JRE and JDK https://javatutorialdetails.blogspot.com/2017/10/java-tutorial-in-details-step-by-step.html

Upvotes: 1

Stephen C
Stephen C

Reputation: 718658

If I have an import for the class Foo, does JVM actually pulls everything from the JAR/library ?

No. Only the classes that are needed at runtime will be loaded by the JVM.

However, if your class A uses library class L1, and class L1 uses another library class L2, then both L1 and L2 will be loaded. Thus you cannot determine if MD5 is used simply by looking at your classes import statements. (There are other reasons too ...)

One way to determine the classes that are actually used is to start the JVM with the command line option -verbose:class. This displays info about each loaded class, including library classes.

Upvotes: 3

Related Questions