Java安全之动态加载字节码( 四 )

但它是一个private方法,还是不能直接调用,继续往上看到getTransletInstance(),
private Translet getTransletInstance()        throws TransformerConfigurationException {        try {            if (_name == null) return null;            if (_class == null) defineTransletClasses();//此处调用defineTransletClasses方法            // The translet needs to keep a reference to all its auxiliary class to prevent the GC from collecting them            AbstractTranslet translet = (AbstractTranslet)                    _class[_transletIndex].getConstructor().newInstance();            translet.postInitialization();            translet.setTemplates(this);            translet.setOverrideDefaultParser(_overrideDefaultParser);            translet.setAllowedProtocols(_accessExternalStylesheet);            if (_auxClasses != null) {                translet.setAuxiliaryClasses(_auxClasses);            }            return translet;        }        catch (InstantiationException | IllegalAccessException |                NoSuchMethodException | InvocationTargetException e) {            ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_OBJECT_ERR, _name);            throw new TransformerConfigurationException(err.toString(), e);        }    }还是private方法,继续找到newTransformer()方法
public synchronized Transformer newTransformer()        throws TransformerConfigurationException    {        TransformerImpl transformer;        transformer = new TransformerImpl(getTransletInstance(), _outputProperties,            _indentNumber, _tfactory);//调用了getTransletInstance方法        if (_uriResolver != null) {            transformer.setURIResolver(_uriResolver);        }        if (_tfactory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)) {            transformer.setSecureProcessing(true);        }        return transformer;    }是public方法了,可以直接调用,所以一条调用链就出来了

经验总结扩展阅读