Expected Behavior

Plugins should not see each others' libraries from the "library loader" feature, except in the case of dependencies between plugins.

Actual Behavior

If and only if a class in a library has already been loaded, other plugins can see the loaded class even when they do not depend on the plugin providing the library. This is incorrect behavior.

How to use the Reproducer

Refer to https://github.com/A248/SpigotLibraryLoaderReproducer

1. Build with maven, "mvn package"
2. Add the two plugins created by the reproducer build to the /plugins directory
3. Start the server
4. Observe log output

Diagnosis

This bug occurs because PluginClassLoader performs a "super.loadClass" call.

    Class<?> loadClass0(@NotNull String name, boolean resolve, boolean checkGlobal, boolean checkLibraries) throws ClassNotFoundException {
        try {
            return super.loadClass(name, resolve);
        } catch (ClassNotFoundException ex) {
        }
    // remaining implementation omitted

As specified in the documentation of ClassLoader, and which is confirmed by the implementation, ClassLoader#loadClass will find an existing loaded class before trying to find the class from a jar file. The logic of loadClass is as follows:

1. If there is an existing Class instance defined to the ClassLoader, yield that Class.
2. Otherwise, check the parent ClassLoader for the Class instance.
3. Otherwise again, check the "findClass" method.

Per the reproducer, when PluginUsingLL loads the Caffeine class, the Caffeine class becomes defined to the ClassLoader of PluginUsingLL. When PluginIndependent later tries to load the Caffeine class, it can now see the Caffeine class from PluginUsingLL.