Overriding a class file from a library JAR in a Java web app

Question

In my Java web app, I have these files:

/WEB-INF/classes/com/example/Foo.class
/WEB-INF/lib/example.jar <-- contains the class "com.example.Foo"

Will the class defined in the classes directory be used instead of the class defined in example.jar?

Thanks.

Solution 1

The answer depends upon your container, it is container dependent. In general, /WEB-INF/classes is preferred to classes in a jar file in WEB-INF/lib.

For Tomcat, the order is the following:

Therefore, from the perspective of a web application, class or resource loading looks in the following repositories, in this order:

1. Bootstrap classes of your JVM
2. System class loader classes
3. /WEB-INF/classes of your web application
4. /WEB-INF/lib/*.jar of your web application
5. Common class loader classes

But if you're using a different container, you need to consult the documentation for that server.

Solution 2

So there is only one way to find out. I wrote a test :)

├── example
│   ├── example.iml
│   ├── pom.xml
│   └── src
│       ├── main
│       │   └── java
│       │       └── test
│       │           ├── Bar.java
│       │           └── Foo.java
│       └── test
│           └── java
│               └── testexample
│                   └── TestFoo.java
├── pom.xml
├── test.iml
└── web
    ├── pom.xml
    ├── src
    │   ├── main
    │   │   └── java
    │   │       └── test
    │   │           └── Foo.java
    │   └── test
    │       └── java
    │           └── junittest
    │               └── TestFooInWeb.java
    └── web.iml

16 directories, 11 files

My finding was that in TestFoo.java prints

Hello from example.jar
Hello from example.jar

And for TestFooInWeb.java prints

Hello from web app
Hello from web app

Both tests have this in the test class:

public class TestFooInWeb/TestFoo {
    @Test
    public void testHello() {
        System.out.println(new Foo().sayHello());
    }

    @Test
    public void testHelloFromBar() {
        new Bar().sayHelloForFoo();
    }
}

So all at the end, I stand corrected. You apprantly can load a completely different class and all Jar files will use that new class. This makes sense because the ClassLoader will first look at the classes directory. I am not sure if I agree with it because it sounds suspicious and I can overwrite security classes.