Details
Description
In its static block, org.apache.commons.io.Java7Support executes:
ClassLoader cl = Thread.currentThread().getContextClassLoader();
This can be null.
In that case, I believe the class should fall back to using:
Java7Support.class.getClassLoader();
But someone with a better understanding of the security implications should weigh in on that change.