I need to create new instance of a class loaded from untrusted classfile. Now I do the following:
classLoader.loadClass(UNSTRUSTED_CLASS).newInstance()
The problem is that if I enable security manager it doesn't permit to call newInstance, but if I have security manager disabled one can put malicious code into initialization block and it executes with no problem.
How one accomplishes creating new instance of untrusted class?