You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@groovy.apache.org by pa...@apache.org on 2022/04/18 07:09:05 UTC

[groovy] 01/02: GROOVY-10586: Revert "GROOVY-10393: Prepare for deprecation of security manager (JEP-411)"

This is an automated email from the ASF dual-hosted git repository.

paulk pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/groovy.git

commit 5f51060cec8c7132e0509d70f579d30a31e16bb1
Author: Paul King <pa...@asert.com.au>
AuthorDate: Mon Apr 18 11:02:14 2022 +1000

    GROOVY-10586: Revert "GROOVY-10393: Prepare for deprecation of security manager (JEP-411)"
    
    This reverts commit d6e5e54b4a0559178d45d7a1b5d6d47b5974817d.
---
 src/main/java/groovy/grape/Grape.java              |  5 ++--
 src/main/java/groovy/lang/GroovyClassLoader.java   | 14 +++++-----
 src/main/java/groovy/lang/GroovyCodeSource.java    |  4 +--
 src/main/java/groovy/lang/GroovyShell.java         | 16 ++++++------
 src/main/java/groovy/lang/MetaClassImpl.java       |  5 ++--
 src/main/java/groovy/ui/GroovyMain.java            |  4 +--
 src/main/java/groovy/util/GroovyScriptEngine.java  |  6 ++---
 .../internal/util/ReevaluatingReference.java       |  4 +--
 .../codehaus/groovy/control/ProcessingUnit.java    |  4 +--
 .../org/codehaus/groovy/control/SourceUnit.java    |  4 +--
 .../codehaus/groovy/reflection/CachedClass.java    | 10 ++++----
 .../org/codehaus/groovy/reflection/ClassInfo.java  |  3 ++-
 .../reflection/ClassLoaderForClassArtifacts.java   |  4 +--
 .../groovy/reflection/ReflectionUtils.java         |  3 ++-
 .../codehaus/groovy/reflection/SunClassLoader.java |  4 +--
 .../reflection/stdclasses/CachedSAMClass.java      |  4 +--
 .../groovy/runtime/DefaultGroovyMethods.java       |  4 +--
 .../groovy/runtime/ProxyGeneratorAdapter.java      | 30 +++++++++++++---------
 .../groovy/runtime/callsite/CallSiteArray.java     |  5 ++--
 .../runtime/callsite/GroovySunClassLoader.java     |  4 +--
 .../org/codehaus/groovy/tools/GroovyStarter.java   |  5 ++--
 .../groovy/tools/javac/JavacJavaCompiler.java      |  4 +--
 .../org/codehaus/groovy/vmplugin/VMPlugin.java     |  9 +++----
 .../org/codehaus/groovy/vmplugin/v8/Java8.java     | 23 +++++++++--------
 src/test/groovy/security/SecurityTest.java         |  4 +--
 src/test/groovy/security/SecurityTestSupport.java  | 12 ++++-----
 .../apache/groovy/parser/antlr4/TestUtils.groovy   |  6 ++---
 .../org/codehaus/groovy/classgen/TestSupport.java  |  6 ++---
 .../codehaus/groovy/ant/CompileTaskSupport.java    |  4 +--
 .../main/java/org/codehaus/groovy/ant/Groovy.java  |  4 +--
 .../main/java/org/codehaus/groovy/ant/Groovyc.java |  4 +--
 .../org/codehaus/groovy/ant/RootLoaderRef.java     |  4 +--
 .../main/groovy/groovy/console/ui/Console.groovy   | 14 ++++++++++
 .../groovy/jsr223/GroovyScriptEngineImpl.java      |  4 +--
 .../groovy-sql/src/main/java/groovy/sql/Sql.java   |  4 +--
 .../swing/binding/ClosureTriggerBinding.java       |  3 +--
 .../groovy/groovy/text/GStringTemplateEngine.java  |  9 +++++--
 .../groovy/text/StreamingTemplateEngine.java       |  9 +++++--
 .../groovy/text/markup/MarkupTemplateEngine.java   |  6 ++---
 .../src/main/java/groovy/test/AllTestSuite.java    |  4 +--
 .../src/main/java/groovy/test/GroovyTestSuite.java |  5 ++--
 .../src/main/java/groovy/xml/FactorySupport.java   |  5 ++--
 42 files changed, 158 insertions(+), 127 deletions(-)

diff --git a/src/main/java/groovy/grape/Grape.java b/src/main/java/groovy/grape/Grape.java
index d3e9289f31..a8dcc88a58 100644
--- a/src/main/java/groovy/grape/Grape.java
+++ b/src/main/java/groovy/grape/Grape.java
@@ -18,10 +18,9 @@
  */
 package groovy.grape;
 
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
-
 import java.lang.reflect.InvocationTargetException;
 import java.net.URI;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Collections;
 import java.util.List;
@@ -158,7 +157,7 @@ public class Grape {
 
     public static void grab(final Map<String, Object> args, final Map... dependencies) {
         if (enableGrapes) {
-            VMPluginFactory.getPlugin().doPrivileged(new PrivilegedAction<Void>() {
+            AccessController.doPrivileged(new PrivilegedAction<Void>() {
                 @Override
                 public Void run() {
                     GrapeEngine instance = getInstance();
diff --git a/src/main/java/groovy/lang/GroovyClassLoader.java b/src/main/java/groovy/lang/GroovyClassLoader.java
index cb154007f2..ffab72ad23 100644
--- a/src/main/java/groovy/lang/GroovyClassLoader.java
+++ b/src/main/java/groovy/lang/GroovyClassLoader.java
@@ -49,7 +49,6 @@ import org.codehaus.groovy.runtime.memoize.EvictableCache;
 import org.codehaus.groovy.runtime.memoize.StampedCommonCache;
 import org.codehaus.groovy.runtime.memoize.UnlimitedConcurrentCache;
 import org.codehaus.groovy.util.URLStreams;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassVisitor;
 import org.objectweb.asm.ClassWriter;
 import org.objectweb.asm.Opcodes;
@@ -67,6 +66,7 @@ import java.net.URL;
 import java.net.URLClassLoader;
 import java.net.URLConnection;
 import java.net.URLDecoder;
+import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.NoSuchAlgorithmException;
 import java.security.Permission;
@@ -111,7 +111,7 @@ public class GroovyClassLoader extends URLClassLoader {
     private GroovyResourceLoader resourceLoader = new GroovyResourceLoader() {
         @Override
         public URL loadGroovySource(final String filename) throws MalformedURLException {
-            return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<URL>) () -> {
+            return AccessController.doPrivileged((PrivilegedAction<URL>) () -> {
                 for (String extension : config.getScriptExtensions()) {
                     try {
                         URL ret = getSourceFile(filename, extension);
@@ -253,7 +253,7 @@ public class GroovyClassLoader extends URLClassLoader {
      * @return the main class defined in the given script
      */
     public Class parseClass(final String text, final String fileName) throws CompilationFailedException {
-        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(text, fileName, "/groovy/script"));
+        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(text, fileName, "/groovy/script"));
         gcs.setCachable(false);
         return parseClass(gcs);
     }
@@ -278,7 +278,7 @@ public class GroovyClassLoader extends URLClassLoader {
     }
 
     public Class parseClass(final Reader reader, final String fileName) throws CompilationFailedException {
-        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> {
+        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> {
             try {
                 String scriptText = IOGroovyMethods.getText(reader);
                 return new GroovyCodeSource(scriptText, fileName, "/groovy/script");
@@ -425,7 +425,7 @@ public class GroovyClassLoader extends URLClassLoader {
                 perms = new Permissions();
             }
 
-            ProtectionDomain myDomain = VMPluginFactory.getPlugin().doPrivileged(new PrivilegedAction<ProtectionDomain>() {
+            ProtectionDomain myDomain = AccessController.doPrivileged(new PrivilegedAction<ProtectionDomain>() {
                 @Override
                 public ProtectionDomain run() {
                     return getClass().getProtectionDomain();
@@ -643,7 +643,7 @@ public class GroovyClassLoader extends URLClassLoader {
      * @return the ClassCollector
      */
     protected ClassCollector createCollector(CompilationUnit unit, SourceUnit su) {
-        InnerLoader loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<InnerLoader>) () -> new InnerLoader(GroovyClassLoader.this));
+        InnerLoader loader = AccessController.doPrivileged((PrivilegedAction<InnerLoader>) () -> new InnerLoader(GroovyClassLoader.this));
         return new ClassCollector(loader, unit, su);
     }
 
@@ -1083,7 +1083,7 @@ public class GroovyClassLoader extends URLClassLoader {
      * @see #addURL(URL)
      */
     public void addClasspath(final String path) {
-        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
 
             URI newURI;
             try {
diff --git a/src/main/java/groovy/lang/GroovyCodeSource.java b/src/main/java/groovy/lang/GroovyCodeSource.java
index f5adac93c2..2ca2a8edc0 100644
--- a/src/main/java/groovy/lang/GroovyCodeSource.java
+++ b/src/main/java/groovy/lang/GroovyCodeSource.java
@@ -22,7 +22,6 @@ import groovy.security.GroovyCodeSourcePermission;
 import groovy.util.CharsetToolkit;
 import org.codehaus.groovy.runtime.IOGroovyMethods;
 import org.codehaus.groovy.runtime.ResourceGroovyMethods;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.FileNotFoundException;
@@ -32,6 +31,7 @@ import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URL;
 import java.net.URLConnection;
+import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
@@ -123,7 +123,7 @@ public class GroovyCodeSource {
         //The calls below require access to user.dir - allow here since getName() and getCodeSource() are
         //package private and used only by the GroovyClassLoader.
         try {
-            Object[] info = VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction<Object[]>) () -> {
+            Object[] info = AccessController.doPrivileged((PrivilegedExceptionAction<Object[]>) () -> {
                 // retrieve the content of the file using the provided encoding
                 if (encoding != null) {
                     scriptText = ResourceGroovyMethods.getText(infile, encoding);
diff --git a/src/main/java/groovy/lang/GroovyShell.java b/src/main/java/groovy/lang/GroovyShell.java
index fc2b3f7ed5..82ab601a9f 100644
--- a/src/main/java/groovy/lang/GroovyShell.java
+++ b/src/main/java/groovy/lang/GroovyShell.java
@@ -26,7 +26,6 @@ import org.codehaus.groovy.control.CompilationFailedException;
 import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.runtime.InvokerHelper;
 import org.codehaus.groovy.runtime.InvokerInvocationException;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
@@ -34,6 +33,7 @@ import java.io.Reader;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.net.URI;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
@@ -100,7 +100,7 @@ public class GroovyShell extends GroovyObjectSupport {
             && ((GroovyClassLoader) parentLoader).hasCompatibleConfiguration(config)) {
           this.loader = (GroovyClassLoader) parentLoader;
         } else {
-          this.loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader,config));
+          this.loader = AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader,config));
         }
         this.context = binding;
         this.config = config;
@@ -203,13 +203,13 @@ public class GroovyShell extends GroovyObjectSupport {
             }
         }
 
-        VMPluginFactory.getPlugin().doPrivileged(new DoSetContext(loader));
+        AccessController.doPrivileged(new DoSetContext(loader));
 
         // Parse the script, generate the class, and invoke the main method.  This is a little looser than
         // if you are compiling the script because the JVM isn't executing the main method.
         Class scriptClass;
         try {
-            scriptClass = VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction<Class>) () -> loader.parseClass(scriptFile));
+            scriptClass = AccessController.doPrivileged((PrivilegedExceptionAction<Class>) () -> loader.parseClass(scriptFile));
         } catch (PrivilegedActionException pae) {
             Exception e = pae.getException();
             if (e instanceof CompilationFailedException) {
@@ -340,7 +340,7 @@ public class GroovyShell extends GroovyObjectSupport {
      * @param args       the command line arguments to pass in
      */
     public Object run(final String scriptText, final String fileName, String[] args) throws CompilationFailedException {
-        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, DEFAULT_CODE_BASE));
+        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, DEFAULT_CODE_BASE));
         return run(gcs, args);
     }
 
@@ -404,7 +404,7 @@ public class GroovyShell extends GroovyObjectSupport {
      * @param args     the command line arguments to pass in
      */
     public Object run(final Reader in, final String fileName, String[] args) throws CompilationFailedException {
-        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(in, fileName, DEFAULT_CODE_BASE));
+        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(in, fileName, DEFAULT_CODE_BASE));
         Class scriptClass = parseClass(gcs);
         return runScriptOrMainOrTestOrRunnable(scriptClass, args);
     }
@@ -462,7 +462,7 @@ public class GroovyShell extends GroovyObjectSupport {
             sm.checkPermission(new GroovyCodeSourcePermission(codeBase));
         }
 
-        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, codeBase));
+        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, codeBase));
 
         return evaluate(gcs);
     }
@@ -607,7 +607,7 @@ public class GroovyShell extends GroovyObjectSupport {
     }
 
     public Script parse(final String scriptText, final String fileName, Binding binding) throws CompilationFailedException {
-        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, DEFAULT_CODE_BASE));
+        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, DEFAULT_CODE_BASE));
         return parse(gcs, binding);
     }
 
diff --git a/src/main/java/groovy/lang/MetaClassImpl.java b/src/main/java/groovy/lang/MetaClassImpl.java
index 9e0213c439..3ae4b24402 100644
--- a/src/main/java/groovy/lang/MetaClassImpl.java
+++ b/src/main/java/groovy/lang/MetaClassImpl.java
@@ -98,6 +98,7 @@ import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.lang.reflect.Proxy;
 import java.net.URL;
+import java.security.AccessController;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 import java.util.ArrayList;
@@ -3495,9 +3496,9 @@ public class MetaClassImpl implements MetaClass, MutableMetaClass {
         //     introspect
         try {
             if (isBeanDerivative(theClass)) {
-                info = (BeanInfo) VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction) () -> Introspector.getBeanInfo(theClass, Introspector.IGNORE_ALL_BEANINFO));
+                info = (BeanInfo) AccessController.doPrivileged((PrivilegedExceptionAction) () -> Introspector.getBeanInfo(theClass, Introspector.IGNORE_ALL_BEANINFO));
             } else {
-                info = (BeanInfo) VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction) () -> Introspector.getBeanInfo(theClass));
+                info = (BeanInfo) AccessController.doPrivileged((PrivilegedExceptionAction) () -> Introspector.getBeanInfo(theClass));
             }
         } catch (PrivilegedActionException pae) {
             throw new GroovyRuntimeException("exception during bean introspection", pae.getException());
diff --git a/src/main/java/groovy/ui/GroovyMain.java b/src/main/java/groovy/ui/GroovyMain.java
index 643fb10dff..10cd8b0ab6 100644
--- a/src/main/java/groovy/ui/GroovyMain.java
+++ b/src/main/java/groovy/ui/GroovyMain.java
@@ -33,7 +33,6 @@ import org.codehaus.groovy.runtime.InvokerInvocationException;
 import org.codehaus.groovy.runtime.ResourceGroovyMethods;
 import org.codehaus.groovy.runtime.StackTraceUtils;
 import org.codehaus.groovy.runtime.StringGroovyMethods;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import picocli.CommandLine;
 import picocli.CommandLine.Command;
 import picocli.CommandLine.IVersionProvider;
@@ -55,6 +54,7 @@ import java.math.BigInteger;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -527,7 +527,7 @@ public class GroovyMain {
             }
         }
 
-        VMPluginFactory.getPlugin().doPrivileged(new DoSetContext(shell.getClassLoader()));
+        AccessController.doPrivileged(new DoSetContext(shell.getClassLoader()));
     }
 
     /**
diff --git a/src/main/java/groovy/util/GroovyScriptEngine.java b/src/main/java/groovy/util/GroovyScriptEngine.java
index f80d771fcd..f4bbd58f84 100644
--- a/src/main/java/groovy/util/GroovyScriptEngine.java
+++ b/src/main/java/groovy/util/GroovyScriptEngine.java
@@ -37,7 +37,6 @@ import org.codehaus.groovy.runtime.IOGroovyMethods;
 import org.codehaus.groovy.runtime.InvokerHelper;
 import org.codehaus.groovy.tools.gse.DependencyTracker;
 import org.codehaus.groovy.tools.gse.StringSetMap;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.BufferedReader;
 import java.io.File;
@@ -48,6 +47,7 @@ import java.lang.ref.WeakReference;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLConnection;
+import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.PrivilegedAction;
 import java.util.HashMap;
@@ -61,7 +61,7 @@ import java.util.concurrent.ConcurrentHashMap;
  * with dependent scripts.
  */
 public class GroovyScriptEngine implements ResourceConnector {
-    private static final ClassLoader CL_STUB = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<ClassLoader>) () -> new ClassLoader() {});
+    private static final ClassLoader CL_STUB = AccessController.doPrivileged((PrivilegedAction<ClassLoader>) () -> new ClassLoader() {});
 
     private static final URL[] EMPTY_URL_ARRAY = new URL[0];
 
@@ -339,7 +339,7 @@ public class GroovyScriptEngine implements ResourceConnector {
      */
     private GroovyClassLoader initGroovyLoader() {
         GroovyClassLoader groovyClassLoader =
-                VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<ScriptClassLoader>) () -> {
+                AccessController.doPrivileged((PrivilegedAction<ScriptClassLoader>) () -> {
                     if (parentLoader instanceof GroovyClassLoader) {
                         return new ScriptClassLoader((GroovyClassLoader) parentLoader);
                     } else {
diff --git a/src/main/java/org/apache/groovy/internal/util/ReevaluatingReference.java b/src/main/java/org/apache/groovy/internal/util/ReevaluatingReference.java
index 3010f054e9..255e97bf40 100644
--- a/src/main/java/org/apache/groovy/internal/util/ReevaluatingReference.java
+++ b/src/main/java/org/apache/groovy/internal/util/ReevaluatingReference.java
@@ -21,13 +21,13 @@ package org.apache.groovy.internal.util;
 
 import org.apache.groovy.lang.annotation.Incubating;
 import org.codehaus.groovy.GroovyBugError;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.lang.invoke.MethodHandle;
 import java.lang.invoke.MethodHandles;
 import java.lang.invoke.MethodType;
 import java.lang.invoke.SwitchPoint;
 import java.lang.ref.WeakReference;
+import java.security.AccessController;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 
@@ -41,7 +41,7 @@ public class ReevaluatingReference<T> {
     static {
         try {
             //TODO Jochen: move the findSpecial to a central place together with others to easy security configuration
-            FALLBACK_HANDLE = VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction<MethodHandle>) () -> MethodHandles.lookup().findSpecial(
+            FALLBACK_HANDLE = AccessController.doPrivileged((PrivilegedExceptionAction<MethodHandle>) () -> MethodHandles.lookup().findSpecial(
                     ReevaluatingReference.class, "replacePayLoad",
                     MethodType.methodType(Object.class),
                     ReevaluatingReference.class));
diff --git a/src/main/java/org/codehaus/groovy/control/ProcessingUnit.java b/src/main/java/org/codehaus/groovy/control/ProcessingUnit.java
index 25ba755bf1..0b12ebf75e 100644
--- a/src/main/java/org/codehaus/groovy/control/ProcessingUnit.java
+++ b/src/main/java/org/codehaus/groovy/control/ProcessingUnit.java
@@ -19,8 +19,8 @@
 package org.codehaus.groovy.control;
 
 import groovy.lang.GroovyClassLoader;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 import static java.util.Objects.requireNonNull;
@@ -100,7 +100,7 @@ public abstract class ProcessingUnit {
     public void setClassLoader(final GroovyClassLoader loader) {
         // ClassLoaders should only be created inside a doPrivileged block in case
         // this method is invoked by code that does not have security permissions.
-        this.classLoader = loader != null ? loader : VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> {
+        this.classLoader = loader != null ? loader : AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> {
             ClassLoader parent = Thread.currentThread().getContextClassLoader();
             if (parent == null) parent = ProcessingUnit.class.getClassLoader();
             return new GroovyClassLoader(parent, getConfiguration());
diff --git a/src/main/java/org/codehaus/groovy/control/SourceUnit.java b/src/main/java/org/codehaus/groovy/control/SourceUnit.java
index 65ccf6c038..703a803043 100644
--- a/src/main/java/org/codehaus/groovy/control/SourceUnit.java
+++ b/src/main/java/org/codehaus/groovy/control/SourceUnit.java
@@ -32,12 +32,12 @@ import org.codehaus.groovy.control.messages.SyntaxErrorMessage;
 import org.codehaus.groovy.syntax.Reduction;
 import org.codehaus.groovy.syntax.SyntaxException;
 import org.codehaus.groovy.tools.Utilities;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
 import java.io.Reader;
 import java.net.URL;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -237,7 +237,7 @@ public class SourceUnit extends ProcessingUnit {
 
         buildAST();
 
-        if ("xml".equals(VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<String>) () -> System.getProperty("groovy.ast")))) {
+        if ("xml".equals(AccessController.doPrivileged((PrivilegedAction<String>) () -> System.getProperty("groovy.ast")))) {
             XStreamUtils.serialize(name, ast);
         }
     }
diff --git a/src/main/java/org/codehaus/groovy/reflection/CachedClass.java b/src/main/java/org/codehaus/groovy/reflection/CachedClass.java
index 647e98f6d8..866692de48 100644
--- a/src/main/java/org/codehaus/groovy/reflection/CachedClass.java
+++ b/src/main/java/org/codehaus/groovy/reflection/CachedClass.java
@@ -30,8 +30,8 @@ import org.codehaus.groovy.runtime.metaclass.ClosureMetaClass;
 import org.codehaus.groovy.util.FastArray;
 import org.codehaus.groovy.util.LazyReference;
 import org.codehaus.groovy.util.ReferenceBundle;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -57,7 +57,7 @@ public class CachedClass {
             PrivilegedAction<CachedField[]> action = () -> Arrays.stream(getTheClass().getDeclaredFields())
                 .filter(f -> ReflectionUtils.checkCanSetAccessible(f, CachedClass.class))
                 .map(CachedField::new).toArray(CachedField[]::new);
-            return VMPluginFactory.getPlugin().doPrivileged(action);
+            return AccessController.doPrivileged(action);
         }
     };
 
@@ -71,7 +71,7 @@ public class CachedClass {
                 .filter(c -> ReflectionUtils.checkCanSetAccessible(c, CachedClass.class))
                 .map(c -> new CachedConstructor(CachedClass.this, c))
                 .toArray(CachedConstructor[]::new);
-            return VMPluginFactory.getPlugin().doPrivileged(action);
+            return AccessController.doPrivileged(action);
         }
     };
 
@@ -91,7 +91,7 @@ public class CachedClass {
                     return CachedMethod.EMPTY_ARRAY;
                 }
             };
-            CachedMethod[] declaredMethods = VMPluginFactory.getPlugin().doPrivileged(action);
+            CachedMethod[] declaredMethods = AccessController.doPrivileged(action);
 
             List<CachedMethod> methods = new ArrayList<>(declaredMethods.length);
             List<CachedMethod> mopMethods = new ArrayList<>(declaredMethods.length);
@@ -139,7 +139,7 @@ public class CachedClass {
 
         @Override
         public CallSiteClassLoader initValue() {
-            return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<CallSiteClassLoader>) () -> new CallSiteClassLoader(CachedClass.this.cachedClass));
+            return AccessController.doPrivileged((PrivilegedAction<CallSiteClassLoader>) () -> new CallSiteClassLoader(CachedClass.this.cachedClass));
         }
     };
 
diff --git a/src/main/java/org/codehaus/groovy/reflection/ClassInfo.java b/src/main/java/org/codehaus/groovy/reflection/ClassInfo.java
index f5faf72483..b4b4f6d238 100644
--- a/src/main/java/org/codehaus/groovy/reflection/ClassInfo.java
+++ b/src/main/java/org/codehaus/groovy/reflection/ClassInfo.java
@@ -54,6 +54,7 @@ import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import java.lang.ref.WeakReference;
 import java.math.BigDecimal;
 import java.math.BigInteger;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Collection;
 import java.util.Iterator;
@@ -449,7 +450,7 @@ public class ClassInfo implements Finalizable {
 
         @Override
         public ClassLoaderForClassArtifacts initValue() {
-            return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<ClassLoaderForClassArtifacts>) () -> new ClassLoaderForClassArtifacts(info.classRef.get()));
+            return AccessController.doPrivileged((PrivilegedAction<ClassLoaderForClassArtifacts>) () -> new ClassLoaderForClassArtifacts(info.classRef.get()));
         }
     }
 
diff --git a/src/main/java/org/codehaus/groovy/reflection/ClassLoaderForClassArtifacts.java b/src/main/java/org/codehaus/groovy/reflection/ClassLoaderForClassArtifacts.java
index e01ee59d16..4995c58ea2 100644
--- a/src/main/java/org/codehaus/groovy/reflection/ClassLoaderForClassArtifacts.java
+++ b/src/main/java/org/codehaus/groovy/reflection/ClassLoaderForClassArtifacts.java
@@ -22,11 +22,11 @@ import groovy.lang.MetaClassImpl;
 import groovy.lang.MetaMethod;
 import org.codehaus.groovy.runtime.callsite.CallSite;
 import org.codehaus.groovy.runtime.callsite.GroovySunClassLoader;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.lang.ref.SoftReference;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Method;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.concurrent.atomic.AtomicInteger;
 
@@ -76,7 +76,7 @@ public class ClassLoaderForClassArtifacts extends ClassLoader {
     }
 
     public Constructor defineClassAndGetConstructor(final String name, final byte[] bytes) {
-        final Class cls = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Class>) () -> define(name, bytes));
+        final Class cls = AccessController.doPrivileged((PrivilegedAction<Class>) () -> define(name, bytes));
 
         if (cls != null) {
             try {
diff --git a/src/main/java/org/codehaus/groovy/reflection/ReflectionUtils.java b/src/main/java/org/codehaus/groovy/reflection/ReflectionUtils.java
index f5e662af6e..1a89ca8203 100644
--- a/src/main/java/org/codehaus/groovy/reflection/ReflectionUtils.java
+++ b/src/main/java/org/codehaus/groovy/reflection/ReflectionUtils.java
@@ -28,6 +28,7 @@ import java.lang.invoke.MethodType;
 import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Array;
 import java.lang.reflect.Method;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -206,7 +207,7 @@ public class ReflectionUtils {
     }
 
     public static Optional<AccessibleObject> makeAccessibleInPrivilegedAction(final AccessibleObject ao) {
-        return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Optional<AccessibleObject>>) () -> makeAccessible(ao));
+        return AccessController.doPrivileged((PrivilegedAction<Optional<AccessibleObject>>) () -> makeAccessible(ao));
     }
 
     // to be run in PrivilegedAction!
diff --git a/src/main/java/org/codehaus/groovy/reflection/SunClassLoader.java b/src/main/java/org/codehaus/groovy/reflection/SunClassLoader.java
index e1c6a571a7..2c78c968f9 100644
--- a/src/main/java/org/codehaus/groovy/reflection/SunClassLoader.java
+++ b/src/main/java/org/codehaus/groovy/reflection/SunClassLoader.java
@@ -19,13 +19,13 @@
 package org.codehaus.groovy.reflection;
 
 import org.codehaus.groovy.control.CompilerConfiguration;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassReader;
 import org.objectweb.asm.ClassWriter;
 import org.objectweb.asm.MethodVisitor;
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.HashMap;
 import java.util.Map;
@@ -46,7 +46,7 @@ public class SunClassLoader extends ClassLoader {
     static {
         SunClassLoader res;
         try {
-            res = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<SunClassLoader>) () -> {
+            res = AccessController.doPrivileged((PrivilegedAction<SunClassLoader>) () -> {
                 try {
                     return new SunClassLoader();
                 } catch (Throwable e) {
diff --git a/src/main/java/org/codehaus/groovy/reflection/stdclasses/CachedSAMClass.java b/src/main/java/org/codehaus/groovy/reflection/stdclasses/CachedSAMClass.java
index 7941235eb8..4800461a33 100644
--- a/src/main/java/org/codehaus/groovy/reflection/stdclasses/CachedSAMClass.java
+++ b/src/main/java/org/codehaus/groovy/reflection/stdclasses/CachedSAMClass.java
@@ -26,11 +26,11 @@ import org.codehaus.groovy.reflection.ClassInfo;
 import org.codehaus.groovy.reflection.ReflectionCache;
 import org.codehaus.groovy.runtime.ConvertedClosure;
 import org.codehaus.groovy.transform.trait.Traits;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.lang.reflect.Proxy;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Arrays;
 import java.util.Collections;
@@ -103,7 +103,7 @@ public class CachedSAMClass extends CachedClass {
     @SuppressWarnings("removal") // TODO a future Groovy version should remove the security check
     private static Method[] getDeclaredMethods(final Class c) {
         try {
-            Method[] methods = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Method[]>) c::getDeclaredMethods);
+            Method[] methods = AccessController.doPrivileged((PrivilegedAction<Method[]>) c::getDeclaredMethods);
             if (methods!=null) return methods;
         } catch (java.security.AccessControlException ace) {
             // swallow and do as if no method is available
diff --git a/src/main/java/org/codehaus/groovy/runtime/DefaultGroovyMethods.java b/src/main/java/org/codehaus/groovy/runtime/DefaultGroovyMethods.java
index 94696f59ac..e6c47a0ee0 100644
--- a/src/main/java/org/codehaus/groovy/runtime/DefaultGroovyMethods.java
+++ b/src/main/java/org/codehaus/groovy/runtime/DefaultGroovyMethods.java
@@ -109,7 +109,6 @@ import org.codehaus.groovy.util.ListBufferedIterator;
 import org.codehaus.groovy.util.LongArrayIterable;
 import org.codehaus.groovy.util.LongArrayIterator;
 import org.codehaus.groovy.util.ShortArrayIterator;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -126,6 +125,7 @@ import java.math.BigDecimal;
 import java.math.BigInteger;
 import java.math.RoundingMode;
 import java.net.URL;
+import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.PrivilegedAction;
 import java.text.MessageFormat;
@@ -462,7 +462,7 @@ public class DefaultGroovyMethods extends DefaultGroovyMethodsSupport {
                     if (groovyObject && field.getName().equals("metaClass")) {
                         continue;
                     }
-                    VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Object>) () -> {
+                    AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
                         ReflectionUtils.trySetAccessible(field);
                         return null;
                     });
diff --git a/src/main/java/org/codehaus/groovy/runtime/ProxyGeneratorAdapter.java b/src/main/java/org/codehaus/groovy/runtime/ProxyGeneratorAdapter.java
index 5a3d3804bb..16beccdabd 100644
--- a/src/main/java/org/codehaus/groovy/runtime/ProxyGeneratorAdapter.java
+++ b/src/main/java/org/codehaus/groovy/runtime/ProxyGeneratorAdapter.java
@@ -34,7 +34,6 @@ import org.codehaus.groovy.control.Phases;
 import org.codehaus.groovy.control.SourceUnit;
 import org.codehaus.groovy.tools.GroovyClass;
 import org.codehaus.groovy.transform.trait.Traits;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassVisitor;
 import org.objectweb.asm.ClassWriter;
 import org.objectweb.asm.Label;
@@ -45,6 +44,7 @@ import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -134,11 +134,11 @@ public class ProxyGeneratorAdapter extends ClassVisitor {
     private static final String[] EMPTY_STRING_ARRAY = new String[0];
 
     static {
-        List<String> names = new ArrayList<String>();
+        List<String> names = new ArrayList<>();
         for (Method method : GroovyObject.class.getMethods()) {
             names.add(method.getName());
         }
-        GROOVYOBJECT_METHOD_NAMESS = new HashSet<String>(names);
+        GROOVYOBJECT_METHOD_NAMESS = new HashSet<>(names);
     }
 
     private final Class<?> superClass;
@@ -181,8 +181,8 @@ public class ProxyGeneratorAdapter extends ClassVisitor {
             final Class delegateClass) {
         super(ASM_API_VERSION, new ClassWriter(ClassWriter.COMPUTE_MAXS | ClassWriter.COMPUTE_FRAMES));
         this.loader = proxyLoader != null ? createInnerLoader(proxyLoader, interfaces) : findClassLoader(superClass, interfaces);
-        this.visitedMethods = new LinkedHashSet<Object>();
-        this.delegatedClosures = closureMap.isEmpty() ? EMPTY_DELEGATECLOSURE_MAP : new HashMap<String, Boolean>();
+        this.visitedMethods = new LinkedHashSet<>();
+        this.delegatedClosures = closureMap.isEmpty() ? EMPTY_DELEGATECLOSURE_MAP : new HashMap<>();
         boolean wildcard = false;
         for (Map.Entry<Object, Object> entry : closureMap.entrySet()) {
             String name = entry.getKey().toString();
@@ -286,8 +286,14 @@ public class ProxyGeneratorAdapter extends ClassVisitor {
         return traits;
     }
 
+    @SuppressWarnings("removal") // TODO a future Groovy version should create the loader not as a privileged action
+    private GroovyClassLoader createClassLoader(ClassLoader parentLoader) {
+        return AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
+    }
+
+    @SuppressWarnings("removal") // TODO a future Groovy version should create the loader not as a privileged action
     private static InnerLoader createInnerLoader(final ClassLoader parent, final Class<?>[] interfaces) {
-        return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<InnerLoader>) () -> new InnerLoader(parent, interfaces));
+        return AccessController.doPrivileged((PrivilegedAction<InnerLoader>) () -> new InnerLoader(parent, interfaces));
     }
 
     private InnerLoader findClassLoader(final Class<?> clazz, final Class<?>[] interfaces) {
@@ -297,9 +303,9 @@ public class ProxyGeneratorAdapter extends ClassVisitor {
     }
 
     private static Set<String> createDelegateMethodList(final Class<?> superClass, final Class<?> delegateClass, final Class<?>[] interfaces) {
-        Set<String> selectedMethods = new HashSet<String>();
-        List<Method> interfaceMethods = new ArrayList<Method>();
-        List<Method> superClassMethods = new ArrayList<Method>();
+        Set<String> selectedMethods = new HashSet<>();
+        List<Method> interfaceMethods = new ArrayList<>();
+        List<Method> superClassMethods = new ArrayList<>();
         Collections.addAll(superClassMethods, superClass.getDeclaredMethods());
         if (interfaces != null) {
             for (Class<?> thisInterface : interfaces) {
@@ -311,7 +317,7 @@ public class ProxyGeneratorAdapter extends ClassVisitor {
                 }
             }
         }
-        List<Method> additionalMethods = getInheritedMethods(delegateClass, new ArrayList<Method>());
+        List<Method> additionalMethods = getInheritedMethods(delegateClass, new ArrayList<>());
         for (Method method : additionalMethods) {
             if (method.getName().indexOf('$') != -1)
                 continue;
@@ -363,7 +369,7 @@ public class ProxyGeneratorAdapter extends ClassVisitor {
 
     @Override
     public void visit(final int version, final int access, final String name, final String signature, final String superName, final String[] interfaces) {
-        Set<String> interfacesSet = new LinkedHashSet<String>();
+        Set<String> interfacesSet = new LinkedHashSet<>();
         if (interfaces != null) Collections.addAll(interfacesSet, interfaces);
         for (Class<?> extraInterface : classList) {
             if (extraInterface.isInterface()) interfacesSet.add(BytecodeHelper.getClassInternalName(extraInterface));
@@ -865,7 +871,7 @@ public class ProxyGeneratorAdapter extends ClassVisitor {
                 for (Class<?> c : interfaces) {
                     if (c.getClassLoader() != parent) {
                         if (internalClassLoaders == null)
-                            internalClassLoaders = new ArrayList<ClassLoader>(interfaces.length);
+                            internalClassLoaders = new ArrayList<>(interfaces.length);
                         if (!internalClassLoaders.contains(c.getClassLoader())) {
                             internalClassLoaders.add(c.getClassLoader());
                         }
diff --git a/src/main/java/org/codehaus/groovy/runtime/callsite/CallSiteArray.java b/src/main/java/org/codehaus/groovy/runtime/callsite/CallSiteArray.java
index 22de80c2c4..5fe58fbae8 100644
--- a/src/main/java/org/codehaus/groovy/runtime/callsite/CallSiteArray.java
+++ b/src/main/java/org/codehaus/groovy/runtime/callsite/CallSiteArray.java
@@ -25,11 +25,12 @@ import groovy.lang.MetaClassImpl;
 import org.codehaus.groovy.reflection.ClassInfo;
 import org.codehaus.groovy.runtime.GroovyCategorySupport;
 import org.codehaus.groovy.runtime.InvokerHelper;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.stream.IntStream;
 
+
 public final class CallSiteArray {
     public static final Object[] NOPARAM = new Object[0];
     public final CallSite[] array;
@@ -59,7 +60,7 @@ public final class CallSiteArray {
     }
 
     private static CallSite createCallStaticSite(CallSite callSite, final Class receiver, Object[] args) {
-        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
             try {
                 Class.forName(receiver.getName(), true, receiver.getClassLoader());
             } catch (Exception e) {
diff --git a/src/main/java/org/codehaus/groovy/runtime/callsite/GroovySunClassLoader.java b/src/main/java/org/codehaus/groovy/runtime/callsite/GroovySunClassLoader.java
index dcb9bce9b3..d16dcc97d1 100644
--- a/src/main/java/org/codehaus/groovy/runtime/callsite/GroovySunClassLoader.java
+++ b/src/main/java/org/codehaus/groovy/runtime/callsite/GroovySunClassLoader.java
@@ -19,13 +19,13 @@
 package org.codehaus.groovy.runtime.callsite;
 
 import org.codehaus.groovy.reflection.SunClassLoader;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassReader;
 import org.objectweb.asm.ClassVisitor;
 import org.objectweb.asm.ClassWriter;
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 import static org.codehaus.groovy.control.CompilerConfiguration.ASM_API_VERSION;
@@ -35,7 +35,7 @@ public class GroovySunClassLoader extends SunClassLoader {
     public static final SunClassLoader sunVM;
 
     static {
-        sunVM = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<SunClassLoader>) () -> {
+        sunVM = AccessController.doPrivileged((PrivilegedAction<SunClassLoader>) () -> {
             try {
                 if (SunClassLoader.sunVM != null) {
                     return new GroovySunClassLoader();
diff --git a/src/main/java/org/codehaus/groovy/tools/GroovyStarter.java b/src/main/java/org/codehaus/groovy/tools/GroovyStarter.java
index 21e7001ff8..4bffd7237b 100644
--- a/src/main/java/org/codehaus/groovy/tools/GroovyStarter.java
+++ b/src/main/java/org/codehaus/groovy/tools/GroovyStarter.java
@@ -18,11 +18,10 @@
  */
 package org.codehaus.groovy.tools;
 
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
-
 import java.io.FileInputStream;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -100,7 +99,7 @@ public class GroovyStarter {
             }
         }
         // create loader and execute main class
-        ClassLoader loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<RootLoader>) () -> new RootLoader(lc));
+        ClassLoader loader = AccessController.doPrivileged((PrivilegedAction<RootLoader>) () -> new RootLoader(lc));
         Method m=null;
         try {
             Class c = loader.loadClass(lc.getMainClass());
diff --git a/src/main/java/org/codehaus/groovy/tools/javac/JavacJavaCompiler.java b/src/main/java/org/codehaus/groovy/tools/javac/JavacJavaCompiler.java
index 1e66bcc39a..c654cdf8e6 100644
--- a/src/main/java/org/codehaus/groovy/tools/javac/JavacJavaCompiler.java
+++ b/src/main/java/org/codehaus/groovy/tools/javac/JavacJavaCompiler.java
@@ -27,7 +27,6 @@ import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.control.messages.ExceptionMessage;
 import org.codehaus.groovy.control.messages.SimpleMessage;
 import org.codehaus.groovy.runtime.DefaultGroovyMethods;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
@@ -35,6 +34,7 @@ import java.net.URISyntaxException;
 import java.net.URL;
 import java.net.URLClassLoader;
 import java.nio.charset.Charset;
+import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
@@ -189,7 +189,7 @@ public class JavacJavaCompiler implements JavaCompiler {
             }
 
             try {
-                CodeSource codeSource = VMPluginFactory.getPlugin().doPrivileged(
+                CodeSource codeSource = AccessController.doPrivileged(
                         (PrivilegedAction<CodeSource>) () -> GroovyObject.class.getProtectionDomain().getCodeSource());
                 if (codeSource != null) {
                     paths.add(new File(codeSource.getLocation().toURI()).getPath());
diff --git a/src/main/java/org/codehaus/groovy/vmplugin/VMPlugin.java b/src/main/java/org/codehaus/groovy/vmplugin/VMPlugin.java
index a3c62ab979..3ba797e91c 100644
--- a/src/main/java/org/codehaus/groovy/vmplugin/VMPlugin.java
+++ b/src/main/java/org/codehaus/groovy/vmplugin/VMPlugin.java
@@ -29,9 +29,6 @@ import java.lang.invoke.MethodHandle;
 import java.lang.invoke.MethodHandles;
 import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Method;
-import java.security.PrivilegedAction;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.Collections;
 import java.util.Map;
 import java.util.Set;
@@ -149,7 +146,8 @@ public interface VMPlugin {
      * @param <T> the type of the value returned by the PrivilegedAction's run method
      * @return the value returned by the action's run method
      */
-    <T> T doPrivileged(PrivilegedAction<T> action);
+    @Deprecated
+    <T> T doPrivileged(java.security.PrivilegedAction<T> action);
 
     /**
      * Performs the specified PrivilegedExceptionAction with privileges enabled on platforms
@@ -159,7 +157,8 @@ public interface VMPlugin {
      * @param <T> the type of the value returned by the PrivilegedAction's run method
      * @return the value returned by the action's run method
      */
-    <T> T doPrivileged(PrivilegedExceptionAction<T> action) throws PrivilegedActionException;
+    @Deprecated
+    <T> T doPrivileged(java.security.PrivilegedExceptionAction<T> action) throws java.security.PrivilegedActionException;
 
     /**
      * transform meta method.
diff --git a/src/main/java/org/codehaus/groovy/vmplugin/v8/Java8.java b/src/main/java/org/codehaus/groovy/vmplugin/v8/Java8.java
index cf015f3657..77f5a6a401 100644
--- a/src/main/java/org/codehaus/groovy/vmplugin/v8/Java8.java
+++ b/src/main/java/org/codehaus/groovy/vmplugin/v8/Java8.java
@@ -68,9 +68,6 @@ import java.lang.reflect.TypeVariable;
 import java.lang.reflect.WildcardType;
 import java.security.AccessController;
 import java.security.Permission;
-import java.security.PrivilegedAction;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
@@ -624,18 +621,22 @@ public class Java8 implements VMPlugin {
     }
 
     @Override
-    public <T> T doPrivileged(PrivilegedAction<T> action) {
-        return AccessController.doPrivileged(action);
+    public MetaMethod transformMetaMethod(final MetaClass metaClass, final MetaMethod metaMethod, final Class<?> caller) {
+        return metaMethod;
     }
 
     @Override
-    public <T> T doPrivileged(PrivilegedExceptionAction<T> action) throws PrivilegedActionException {
-        return AccessController.doPrivileged(action);
+    @Deprecated
+    @SuppressWarnings("removal") // TODO a future Groovy version will remove this method
+    public <T> T doPrivileged(java.security.PrivilegedAction<T> action) {
+        throw new UnsupportedOperationException("doPrivileged is no longer supported");
     }
 
     @Override
-    public MetaMethod transformMetaMethod(final MetaClass metaClass, final MetaMethod metaMethod, final Class<?> caller) {
-        return metaMethod;
+    @Deprecated
+    @SuppressWarnings("removal") // TODO a future Groovy version will remove this method
+    public <T> T doPrivileged(java.security.PrivilegedExceptionAction<T> action) throws java.security.PrivilegedActionException {
+        throw new UnsupportedOperationException("doPrivileged is no longer supported");
     }
 
     @Override
@@ -669,7 +670,7 @@ public class Java8 implements VMPlugin {
 
     private Object getInvokeSpecialHandleFallback(final Method method, final Object receiver) {
         if (!method.isAccessible()) {
-            AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
+            AccessController.doPrivileged((java.security.PrivilegedAction<Object>) () -> {
                 ReflectionUtils.trySetAccessible(method);
                 return null;
             });
@@ -714,7 +715,7 @@ public class Java8 implements VMPlugin {
             try {
                 if (!lookup.isAccessible()) {
                     final Constructor<MethodHandles.Lookup> finalReference = lookup;
-                    AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
+                    AccessController.doPrivileged((java.security.PrivilegedAction<Object>) () -> {
                         ReflectionUtils.trySetAccessible(finalReference);
                         return null;
                     });
diff --git a/src/test/groovy/security/SecurityTest.java b/src/test/groovy/security/SecurityTest.java
index 53c51db997..cae37ec757 100644
--- a/src/test/groovy/security/SecurityTest.java
+++ b/src/test/groovy/security/SecurityTest.java
@@ -20,12 +20,12 @@ package groovy.security;
 
 import groovy.lang.GroovyCodeSource;
 import org.codehaus.groovy.control.CompilationFailedException;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.junit.Ignore;
 
 import java.io.File;
 import java.io.IOException;
 import java.net.URL;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.security.Security;
 import java.util.PropertyPermission;
@@ -63,7 +63,7 @@ public class SecurityTest extends SecurityTestSupport {
         // Use our privileged access in order to prevent checks lower in the call stack.  Otherwise we would have
         // to grant access to IDE unit test runners and unit test libs.  We only care about testing the call stack
         // higher upstream from this point of execution.
-        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
             Security.setProperty("package.access", "javax.print");
             return null;
         });
diff --git a/src/test/groovy/security/SecurityTestSupport.java b/src/test/groovy/security/SecurityTestSupport.java
index 719c621656..be33f9fdd6 100644
--- a/src/test/groovy/security/SecurityTestSupport.java
+++ b/src/test/groovy/security/SecurityTestSupport.java
@@ -29,12 +29,12 @@ import junit.framework.TestResult;
 import junit.framework.TestSuite;
 import junit.textui.ResultPrinter;
 import org.codehaus.groovy.runtime.InvokerHelper;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.security.AccessControlException;
+import java.security.AccessController;
 import java.security.Permission;
 import java.security.Policy;
 import java.security.PrivilegedAction;
@@ -92,7 +92,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
     }
 
     protected GroovyClassLoader loader =
-            VMPluginFactory.getPlugin().doPrivileged(
+            AccessController.doPrivileged(
                     (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(SecurityTestSupport.class.getClassLoader())
             );
 
@@ -132,7 +132,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
             }
         }
         currentClassLoader = Thread.currentThread().getContextClassLoader();
-        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction) () -> {
+        AccessController.doPrivileged((PrivilegedAction) () -> {
             Thread.currentThread().setUncaughtExceptionHandler(new Thread.UncaughtExceptionHandler() {
                 @Override
                 public void uncaughtException(Thread t, Throwable e) {
@@ -145,7 +145,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
     }
 
     protected void tearDown() {
-        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction) () -> {
+        AccessController.doPrivileged((PrivilegedAction) () -> {
             System.setSecurityManager(securityManager);
             Thread.currentThread().setContextClassLoader(currentClassLoader);
             return null;
@@ -271,7 +271,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
         // Use our privileged access in order to prevent checks lower in the call stack.  Otherwise we would have
         // to grant access to IDE unit test runners and unit test libs.  We only care about testing the call stack
         // higher upstream from this point of execution.
-        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
             GroovyCodeSource gcs = null;
             try {
                 gcs = new GroovyCodeSource(file);
@@ -296,7 +296,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
         // Use our privileged access in order to prevent checks lower in the call stack.  Otherwise we would have
         // to grant access to IDE unit test runners and unit test libs.  We only care about testing the call stack
         // higher upstream from this point of execution.
-        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
             parseAndExecute(new GroovyCodeSource(scriptStr, generateClassName(), effectiveCodeBase), missingPermission);
             return null;
         });
diff --git a/src/test/org/apache/groovy/parser/antlr4/TestUtils.groovy b/src/test/org/apache/groovy/parser/antlr4/TestUtils.groovy
index 125562a242..c8aae4bc70 100644
--- a/src/test/org/apache/groovy/parser/antlr4/TestUtils.groovy
+++ b/src/test/org/apache/groovy/parser/antlr4/TestUtils.groovy
@@ -46,8 +46,8 @@ import org.codehaus.groovy.control.ParserPlugin
 import org.codehaus.groovy.control.ParserPluginFactory
 import org.codehaus.groovy.control.SourceUnit
 import org.codehaus.groovy.syntax.Token
-import org.codehaus.groovy.vmplugin.VMPluginFactory
 
+import java.security.AccessController
 import java.security.PrivilegedAction
 import java.util.zip.ZipEntry
 import java.util.zip.ZipFile
@@ -222,7 +222,7 @@ final class TestUtils {
     }
 
     private static ModuleNode buildAST(File sourceFile, CompilerConfiguration config) {
-        def loader = VMPluginFactory.getPlugin().doPrivileged({ ->
+        def loader = AccessController.doPrivileged({ ->
             new GroovyClassLoader()
         } as PrivilegedAction<GroovyClassLoader>)
 
@@ -242,7 +242,7 @@ final class TestUtils {
     }
 
     private static ModuleNode buildAST(String sourceText, CompilerConfiguration config) {
-        def loader = VMPluginFactory.getPlugin().doPrivileged({ ->
+        def loader = AccessController.doPrivileged({ ->
             new GroovyClassLoader()
         } as PrivilegedAction<GroovyClassLoader>)
 
diff --git a/src/testFixtures/groovy/org/codehaus/groovy/classgen/TestSupport.java b/src/testFixtures/groovy/org/codehaus/groovy/classgen/TestSupport.java
index d882724a6c..0f60cca183 100644
--- a/src/testFixtures/groovy/org/codehaus/groovy/classgen/TestSupport.java
+++ b/src/testFixtures/groovy/org/codehaus/groovy/classgen/TestSupport.java
@@ -34,7 +34,6 @@ import org.codehaus.groovy.ast.expr.MethodCallExpression;
 import org.codehaus.groovy.ast.stmt.ExpressionStatement;
 import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.runtime.InvokerHelper;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.junit.Ignore;
 import org.objectweb.asm.Opcodes;
 
@@ -45,6 +44,7 @@ import java.io.File;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -57,7 +57,7 @@ public class TestSupport extends GroovyTestCase implements Opcodes {
 
     final ClassLoader parentLoader = getClass().getClassLoader();
     protected final GroovyClassLoader loader =
-            VMPluginFactory.getPlugin().doPrivileged(
+            AccessController.doPrivileged(
                     (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader)
             );
     final CompileUnit unit = new CompileUnit(loader, new CompilerConfiguration());
@@ -137,7 +137,7 @@ public class TestSupport extends GroovyTestCase implements Opcodes {
     protected void assertScript(final String text, final String scriptName) throws Exception {
         log.info("About to execute script");
         log.info(text);
-        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged(
+        GroovyCodeSource gcs = AccessController.doPrivileged(
                 (PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(text, scriptName, "/groovy/testSupport")
         );
         Class<?> groovyClass = loader.parseClass(gcs);
diff --git a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/CompileTaskSupport.java b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/CompileTaskSupport.java
index 24523c3325..56ba6949f2 100644
--- a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/CompileTaskSupport.java
+++ b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/CompileTaskSupport.java
@@ -26,11 +26,11 @@ import org.apache.tools.ant.types.Path;
 import org.apache.tools.ant.types.Reference;
 import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.tools.ErrorReporter;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.PrintWriter;
 import java.io.Writer;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -136,7 +136,7 @@ public abstract class CompileTaskSupport
 
     protected GroovyClassLoader createClassLoader() {
         GroovyClassLoader gcl =
-                VMPluginFactory.getPlugin().doPrivileged(
+                AccessController.doPrivileged(
                         (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(ClassLoader.getSystemClassLoader(), config));
 
         Path path = getClasspath();
diff --git a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovy.java b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovy.java
index 4d15d2d80c..c44e2bfc87 100644
--- a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovy.java
+++ b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovy.java
@@ -46,7 +46,6 @@ import org.codehaus.groovy.reflection.ReflectionUtils;
 import org.codehaus.groovy.runtime.InvokerHelper;
 import org.codehaus.groovy.runtime.ResourceGroovyMethods;
 import org.codehaus.groovy.tools.ErrorReporter;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
@@ -63,6 +62,7 @@ import java.io.Reader;
 import java.io.Writer;
 import java.lang.reflect.Field;
 import java.nio.charset.Charset;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.List;
 import java.util.Vector;
@@ -563,7 +563,7 @@ public class Groovy extends Java {
 
         final String scriptName = computeScriptName();
         final GroovyClassLoader classLoader =
-                VMPluginFactory.getPlugin().doPrivileged(
+                AccessController.doPrivileged(
                         (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(baseClassLoader));
         addClassPathes(classLoader);
         configureCompiler();
diff --git a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovyc.java b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovyc.java
index 76a6861df8..64dc16fa8c 100644
--- a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovyc.java
+++ b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovyc.java
@@ -42,7 +42,6 @@ import org.codehaus.groovy.runtime.DefaultGroovyStaticMethods;
 import org.codehaus.groovy.tools.ErrorReporter;
 import org.codehaus.groovy.tools.FileSystemCompiler;
 import org.codehaus.groovy.tools.javac.JavaAwareCompilationUnit;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassVisitor;
 import picocli.CommandLine;
 
@@ -54,6 +53,7 @@ import java.io.Writer;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.nio.charset.Charset;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -1443,7 +1443,7 @@ public class Groovyc extends MatchingTask {
             }
         }
 
-        GroovyClassLoader groovyLoader = VMPluginFactory.getPlugin().doPrivileged(
+        GroovyClassLoader groovyLoader = AccessController.doPrivileged(
                 (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(loader, configuration));
         if (!forceLookupUnnamedFiles) {
             // in normal case we don't need to do script lookups
diff --git a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/RootLoaderRef.java b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/RootLoaderRef.java
index 247c34ca40..a8d96b0c7a 100644
--- a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/RootLoaderRef.java
+++ b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/RootLoaderRef.java
@@ -26,8 +26,8 @@ import org.apache.tools.ant.types.Path;
 import org.apache.tools.ant.types.Reference;
 import org.codehaus.groovy.tools.LoaderConfiguration;
 import org.codehaus.groovy.tools.RootLoader;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -88,7 +88,7 @@ public class RootLoaderRef extends MatchingTask {
             }
             lc.addFile(s);
         }
-        AntClassLoader loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<AntClassLoader>) () -> new AntClassLoader(new RootLoader(lc), true));
+        AntClassLoader loader = AccessController.doPrivileged((PrivilegedAction<AntClassLoader>) () -> new AntClassLoader(new RootLoader(lc), true));
         project.addReference(name, loader);
     }
 
diff --git a/subprojects/groovy-console/src/main/groovy/groovy/console/ui/Console.groovy b/subprojects/groovy-console/src/main/groovy/groovy/console/ui/Console.groovy
index 81c12c32a6..1cdfd464d5 100644
--- a/subprojects/groovy-console/src/main/groovy/groovy/console/ui/Console.groovy
+++ b/subprojects/groovy-console/src/main/groovy/groovy/console/ui/Console.groovy
@@ -60,6 +60,7 @@ import org.codehaus.groovy.vmplugin.VMPluginFactory
 
 import javax.swing.Action
 import javax.swing.Icon
+import javax.swing.JApplet
 import javax.swing.JFileChooser
 import javax.swing.JFrame
 import javax.swing.JLabel
@@ -414,6 +415,19 @@ class Console implements CaretListener, HyperlinkListener, ComponentListener, Fo
         run(frameConsoleDelegates)
     }
 
+    @Deprecated
+    void run(JApplet applet) {
+        run([
+                rootContainerDelegate: {
+                    containingWindows += SwingUtilities.getRoot(applet.getParent())
+                    applet
+                },
+                menuBarDelegate      : { arg ->
+                    current.JMenuBar = build(arg)
+                }
+        ])
+    }
+
     void run(Map defaults) {
 
         swing = new SwingBuilder()
diff --git a/subprojects/groovy-jsr223/src/main/java/org/codehaus/groovy/jsr223/GroovyScriptEngineImpl.java b/subprojects/groovy-jsr223/src/main/java/org/codehaus/groovy/jsr223/GroovyScriptEngineImpl.java
index 8de6304b30..540a155435 100644
--- a/subprojects/groovy-jsr223/src/main/java/org/codehaus/groovy/jsr223/GroovyScriptEngineImpl.java
+++ b/subprojects/groovy-jsr223/src/main/java/org/codehaus/groovy/jsr223/GroovyScriptEngineImpl.java
@@ -62,7 +62,6 @@ import org.codehaus.groovy.runtime.MetaClassHelper;
 import org.codehaus.groovy.runtime.MethodClosure;
 import org.codehaus.groovy.util.ManagedConcurrentValueMap;
 import org.codehaus.groovy.util.ReferenceBundle;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import javax.script.AbstractScriptEngine;
 import javax.script.Bindings;
@@ -80,6 +79,7 @@ import java.io.Reader;
 import java.io.Writer;
 import java.lang.reflect.Method;
 import java.lang.reflect.Proxy;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -109,7 +109,7 @@ public class GroovyScriptEngineImpl extends AbstractScriptEngine implements Comp
     }
 
     public GroovyScriptEngineImpl() {
-        this(VMPluginFactory.getPlugin().doPrivileged(new PrivilegedAction<GroovyClassLoader>() {
+        this(AccessController.doPrivileged(new PrivilegedAction<GroovyClassLoader>() {
             @Override
             public GroovyClassLoader run() {
                 return new GroovyClassLoader(getParentLoader(), new CompilerConfiguration(CompilerConfiguration.DEFAULT));
diff --git a/subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java b/subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java
index 946e1ac024..5551f70d23 100644
--- a/subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java
+++ b/subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java
@@ -27,10 +27,10 @@ import groovy.transform.stc.ClosureParams;
 import groovy.transform.stc.FromString;
 import groovy.transform.stc.SimpleType;
 import org.codehaus.groovy.runtime.InvokerHelper;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import javax.sql.DataSource;
 
+import java.security.AccessController;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 import java.sql.CallableStatement;
@@ -4302,7 +4302,7 @@ public class Sql implements AutoCloseable {
             // read, and the policy shouldn't have to list them all.
             Connection con;
             try {
-                con = VMPluginFactory.getPlugin().doPrivileged(new PrivilegedExceptionAction<Connection>() {
+                con = AccessController.doPrivileged(new PrivilegedExceptionAction<Connection>() {
                     @Override
                     public Connection run() throws SQLException {
                         return dataSource.getConnection();
diff --git a/subprojects/groovy-swing/src/main/java/org/apache/groovy/swing/binding/ClosureTriggerBinding.java b/subprojects/groovy-swing/src/main/java/org/apache/groovy/swing/binding/ClosureTriggerBinding.java
index 4f6cce1049..44b6905480 100644
--- a/subprojects/groovy-swing/src/main/java/org/apache/groovy/swing/binding/ClosureTriggerBinding.java
+++ b/subprojects/groovy-swing/src/main/java/org/apache/groovy/swing/binding/ClosureTriggerBinding.java
@@ -22,7 +22,6 @@ import groovy.lang.Closure;
 import groovy.lang.GroovyObjectSupport;
 import groovy.lang.Reference;
 import org.codehaus.groovy.reflection.ReflectionUtils;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Constructor;
@@ -73,7 +72,7 @@ public class ClosureTriggerBinding implements TriggerBinding, SourceBinding {
             final Class closureClass = closure.getClass();
 
             // do in privileged block since we may be looking at private stuff
-            Closure closureLocalCopy = VMPluginFactory.getPlugin().doPrivileged(new PrivilegedAction<Closure>() {
+            Closure closureLocalCopy = java.security.AccessController.doPrivileged(new PrivilegedAction<Closure>() {
                 @Override
                 public Closure run() {
                     // assume closures have only 1 constructor, of the form (Object, Reference*)
diff --git a/subprojects/groovy-templates/src/main/groovy/groovy/text/GStringTemplateEngine.java b/subprojects/groovy-templates/src/main/groovy/groovy/text/GStringTemplateEngine.java
index 0d43e6f396..5ec22b7112 100644
--- a/subprojects/groovy-templates/src/main/groovy/groovy/text/GStringTemplateEngine.java
+++ b/subprojects/groovy-templates/src/main/groovy/groovy/text/GStringTemplateEngine.java
@@ -27,11 +27,11 @@ import groovy.lang.GroovyRuntimeException;
 import groovy.lang.Writable;
 import org.apache.groovy.util.SystemUtil;
 import org.codehaus.groovy.control.CompilationFailedException;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.IOException;
 import java.io.Reader;
 import java.lang.reflect.InvocationTargetException;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -193,7 +193,7 @@ public class GStringTemplateEngine extends TemplateEngine {
             final GroovyClassLoader loader =
                     REUSE_CLASS_LOADER && parentLoader instanceof GroovyClassLoader
                             ? (GroovyClassLoader) parentLoader
-                            : VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
+                            : createClassLoader(parentLoader);
             final Class<?> groovyClass;
             try {
                 groovyClass = loader.parseClass(new GroovyCodeSource(templateExpressions.toString(), "GStringTemplateScript" + counter.incrementAndGet() + ".groovy", "x"));
@@ -214,6 +214,11 @@ public class GStringTemplateEngine extends TemplateEngine {
             }
         }
 
+        @SuppressWarnings("removal") // TODO a future Groovy version should create the loader not as a privileged action
+        private GroovyClassLoader createClassLoader(ClassLoader parentLoader) {
+            return AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
+        }
+
         private static void appendCharacter(final char c,
                                             final StringBuilder templateExpressions,
                                             final boolean writingString) {
diff --git a/subprojects/groovy-templates/src/main/groovy/groovy/text/StreamingTemplateEngine.java b/subprojects/groovy-templates/src/main/groovy/groovy/text/StreamingTemplateEngine.java
index 8f5a210aed..65907d3003 100644
--- a/subprojects/groovy-templates/src/main/groovy/groovy/text/StreamingTemplateEngine.java
+++ b/subprojects/groovy-templates/src/main/groovy/groovy/text/StreamingTemplateEngine.java
@@ -32,13 +32,13 @@ import org.codehaus.groovy.control.messages.Message;
 import org.codehaus.groovy.control.messages.SyntaxErrorMessage;
 import org.codehaus.groovy.runtime.StackTraceUtils;
 import org.codehaus.groovy.syntax.SyntaxException;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.IOException;
 import java.io.LineNumberReader;
 import java.io.Reader;
 import java.io.StringReader;
 import java.lang.reflect.InvocationTargetException;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.List;
@@ -595,7 +595,7 @@ public class StreamingTemplateEngine extends TemplateEngine {
         }
 
         private Closure createTemplateClosure(List<StringSection> sections, final ClassLoader parentLoader, StringBuilder target) throws ClassNotFoundException {
-            final GroovyClassLoader loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
+            final GroovyClassLoader loader = createClassLoader(parentLoader);
             final Class<?> groovyClass;
             try {
                 groovyClass = loader.parseClass(new GroovyCodeSource(target.toString(), TEMPLATE_SCRIPT_PREFIX + COUNTER.incrementAndGet() + ".groovy", "x"));
@@ -619,6 +619,11 @@ public class StreamingTemplateEngine extends TemplateEngine {
             return result;
         }
 
+        @SuppressWarnings("removal") // TODO a future Groovy version should create the loader not as a privileged action
+        private GroovyClassLoader createClassLoader(ClassLoader parentLoader) {
+            return AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
+        }
+
         /**
          * Parses a non curly dollar preceded identifier of the type
          * '$bird' in the following template example:
diff --git a/subprojects/groovy-templates/src/main/groovy/groovy/text/markup/MarkupTemplateEngine.java b/subprojects/groovy-templates/src/main/groovy/groovy/text/markup/MarkupTemplateEngine.java
index 9317bf1a7c..abbbd0eed8 100644
--- a/subprojects/groovy-templates/src/main/groovy/groovy/text/markup/MarkupTemplateEngine.java
+++ b/subprojects/groovy-templates/src/main/groovy/groovy/text/markup/MarkupTemplateEngine.java
@@ -35,7 +35,6 @@ import org.codehaus.groovy.control.SourceUnit;
 import org.codehaus.groovy.control.customizers.ASTTransformationCustomizer;
 import org.codehaus.groovy.control.customizers.CompilationCustomizer;
 import org.codehaus.groovy.runtime.DefaultGroovyMethods;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
@@ -44,6 +43,7 @@ import java.io.StringReader;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Collections;
 import java.util.LinkedHashMap;
@@ -101,7 +101,7 @@ public class MarkupTemplateEngine extends TemplateEngine {
                     }
             );
         }
-        groovyClassLoader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<TemplateGroovyClassLoader>) () -> new TemplateGroovyClassLoader(parentLoader, compilerConfiguration));
+        groovyClassLoader = AccessController.doPrivileged((PrivilegedAction<TemplateGroovyClassLoader>) () -> new TemplateGroovyClassLoader(parentLoader, compilerConfiguration));
         if (DEBUG_BYTECODE) {
             compilerConfiguration.setBytecodePostprocessor(BytecodeDumper.STANDARD_ERR);
         }
@@ -116,7 +116,7 @@ public class MarkupTemplateEngine extends TemplateEngine {
      * @param tplConfig         template engine configuration
      */
     public MarkupTemplateEngine(final ClassLoader parentLoader, final File templateDirectory, TemplateConfiguration tplConfig) {
-        this(VMPluginFactory.getPlugin().doPrivileged(
+        this(AccessController.doPrivileged(
                 new PrivilegedAction<URLClassLoader>() {
                     @Override
                     public URLClassLoader run() {
diff --git a/subprojects/groovy-test/src/main/java/groovy/test/AllTestSuite.java b/subprojects/groovy-test/src/main/java/groovy/test/AllTestSuite.java
index a9b800279b..757be72844 100644
--- a/subprojects/groovy-test/src/main/java/groovy/test/AllTestSuite.java
+++ b/subprojects/groovy-test/src/main/java/groovy/test/AllTestSuite.java
@@ -26,10 +26,10 @@ import junit.framework.TestCase;
 import junit.framework.TestSuite;
 import org.codehaus.groovy.control.CompilationFailedException;
 import org.apache.groovy.test.ScriptTestAdapter;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.List;
 import java.util.logging.Logger;
@@ -78,7 +78,7 @@ public class AllTestSuite extends TestSuite {
     private static final Logger LOG = Logger.getLogger(AllTestSuite.class.getName());
     private static final ClassLoader JAVA_LOADER = AllTestSuite.class.getClassLoader();
     private static final GroovyClassLoader GROOVY_LOADER =
-            VMPluginFactory.getPlugin().doPrivileged(
+            AccessController.doPrivileged(
                     (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(JAVA_LOADER)
             );
 
diff --git a/subprojects/groovy-test/src/main/java/groovy/test/GroovyTestSuite.java b/subprojects/groovy-test/src/main/java/groovy/test/GroovyTestSuite.java
index 71dd2eb2e7..eb1553e733 100644
--- a/subprojects/groovy-test/src/main/java/groovy/test/GroovyTestSuite.java
+++ b/subprojects/groovy-test/src/main/java/groovy/test/GroovyTestSuite.java
@@ -25,11 +25,12 @@ import junit.framework.TestCase;
 import junit.framework.TestSuite;
 import junit.textui.TestRunner;
 import org.apache.groovy.test.ScriptTestAdapter;
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
+import java.security.AccessController;
 import java.security.PrivilegedAction;
 
+
 /**
  * A TestSuite which will run a Groovy unit test case inside any Java IDE
  * either as a unit test case or as an application.
@@ -51,7 +52,7 @@ public class GroovyTestSuite extends TestSuite {
     protected static String file = null;
 
     protected final GroovyClassLoader loader =
-            VMPluginFactory.getPlugin().doPrivileged(
+            AccessController.doPrivileged(
                     (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(GroovyTestSuite.class.getClassLoader())
             );
 
diff --git a/subprojects/groovy-xml/src/main/java/groovy/xml/FactorySupport.java b/subprojects/groovy-xml/src/main/java/groovy/xml/FactorySupport.java
index 7066362618..a6d57c7c60 100644
--- a/subprojects/groovy-xml/src/main/java/groovy/xml/FactorySupport.java
+++ b/subprojects/groovy-xml/src/main/java/groovy/xml/FactorySupport.java
@@ -18,11 +18,10 @@
  */
 package groovy.xml;
 
-import org.codehaus.groovy.vmplugin.VMPluginFactory;
-
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParserFactory;
+import java.security.AccessController;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 
@@ -33,7 +32,7 @@ public class FactorySupport {
     static Object createFactory(PrivilegedExceptionAction action) throws ParserConfigurationException {
         Object factory;
         try {
-            factory = VMPluginFactory.getPlugin().doPrivileged(action);
+            factory = AccessController.doPrivileged(action);
         } catch (PrivilegedActionException pae) {
             Exception e = pae.getException();
             if (e instanceof ParserConfigurationException) {