The short answer is that implementation is part of Sunβs internal work and is not available through public funds. getURLs() only ever return the URLs that were passed. There is a longer answer, but this is only for courage.
Going through the Oracle JVM 8 with the debugger led me to an almost identical structure like OpenJDK6, and you can see where it loads the class path here .
Basically, the class loader stores a stack of URLs that it has not yet parsed in memory. When asked to load a class, it pops the URLs from the stack, loads them in the form of class files or jar files, and if they are jar files, it will read the manifest and move the class path entries onto the stack. Each time it processes a file, it adds a βloaderβ that downloads the file to the loader card (if nothing else, to ensure that it does not process the same file several times).
You can access this map if you are really motivated (not recommended):
Field secretField = URLClassLoader.class.getDeclaredField("ucp"); secretField.setAccessible(true); Object ucp = secretField.get(loader); secretField = ucp.getClass().getDeclaredField("lmap"); secretField.setAccessible(true); return secretField.get(ucp);
By running this on a dummy setup, where I have dummy-plugin.jar that references external.jar (in the dummy-plugin.jar manifest), I get the following:
1) Immediately after creating the class loader (before loading any class):
urlClassLoader.getURLs()=[file:.../dummy-plugin.jar] getSecretUrlsStack=[file:.../dummy-plugin.jar] getSecretLmapField={}
2) After loading the class from dummy-plugin.jar:
urlClassLoader.getURLs()=[file:.../dummy-plugin.jar] getSecretUrlsStack=[file:.../external.jar] getSecretLmapField={file:.../ dummy-plugin.jar=sun.misc.URLClassPath$JarLoader@736e9adb }
3) After loading the class from external.jar:
urlClassLoader.getURLs()=[file:.../dummy-plugin.jar] getSecretUrlsStack=[] getSecretLmapField={file:.../ dummy-plugin.jar=sun.misc.URLClassPath$JarLoader@736e9adb , file:.../ external.jar=sun.misc.URLClassPath$JarLoader@2d8e6db6 }
Oddly enough, it seems like it flies in front of the JDK for URLClassLoader :
By default, loadable classes only get permission to access the URLs specified when creating the URLClassLoader.