public JasperLoader(URL[] urls,
    ClassLoader parent,
    PermissionCollection permissionCollection,
    CodeSource codeSource) 
{
	super(urls, parent);
	this.permissionCollection = permissionCollection;
	this.codeSource = codeSource;
	this.parent = parent;
	this.securityManager = System.getSecurityManager();
}

 public final PermissionCollection getPermissions(CodeSource codeSource) 
{
        return permissionCollection;
}

Get the Permissions for a CodeSource. Since this ClassLoader is only used for a JSP page in a web application context, we just return our preset PermissionCollection for the web app context.

 public InputStream getResourceAsStream(String name) 
{
        InputStream is = parent.getResourceAsStream(name);
        if (is == null) {
            URL url = findResource(name);
            if (url != null) {
                try {
                    is = url.openStream();
                } catch (IOException e) {
                    is = null;
                }
            }
        }
        return is;
}

Delegate to parent

 public Class loadClass(String name) throws ClassNotFoundException 
{
        return (loadClass(name, false));
}

Load the class with the specified name. This method searches for classes in the same manner as loadClass(String, boolean) with false as the second argument.

 public Class loadClass(String name,
    boolean resolve) throws ClassNotFoundException 
{
        Class clazz = null;                
        // (0) Check our previously loaded class cache
        clazz = findLoadedClass(name);     
        if (clazz != null) {               
            if (resolve)                   
                resolveClass(clazz);       
            return (clazz);        
        }                          
        // (.5) Permission to access this class when using a SecurityManager
        if (securityManager != null) {     
            int dot = name.lastIndexOf('.");
            if (dot  >= 0) {                
                try {        
                    // Do not call the security manager since by default, we grant that package.
                    if (!"org.apache.jasper.runtime".equalsIgnoreCase(name.substring(0,dot))){
                        securityManager.checkPackageAccess(name.substring(0,dot));
                    }
                } catch (SecurityException se) {
                    String error = "Security Violation, attempt to use " +
                        "Restricted Class: " + name;
                    se.printStackTrace();
                    throw new ClassNotFoundException(error);
                }                          
            }                              
        }
	if( !name.startsWith(Constants.JSP_PACKAGE_NAME) ) {
            // Class is not in org.apache.jsp, therefore, have our
            // parent load it
            clazz = parent.loadClass(name);            
	    if( resolve )
		resolveClass(clazz);
	    return clazz;
	}
	return findClass(name);
}

Load the class with the specified name, searching using the following algorithm until it finds and returns the class. If the class cannot be found, returns ClassNotFoundException.
• Call findLoadedClass(String) to check if the class has already been loaded. If it has, the same Class object is returned.
• If the delegate property is set to true, call the loadClass() method of the parent class loader, if any.
• Call findClass() to find this class in our locally defined repositories.
• Call the loadClass() method of our parent class loader, if any.
If the class was found using the above steps, and the resolve flag is true, this method will then call resolveClass(Class) on the resulting Class object.