See RT-16904 for details on why calling ClassLoader.getSystemClassLoader() or ClassLoader.getSystemResource() to get a codebase is a bad idea. First of all, if this is called from user code it will raise a SecurityException. Second, using the URL resulting from ClassLoader.getSystemResource("") as a codebase against which to resolve relative URLs won't work.