code: @Override
      public PermissionCollection getCombinedPermissions(PermissionCollection staticPolicyPermissionCollection, CodeSource codesource) {
          Permissions effectivePermissions = new Permissions();
          List<Permission> staticPolicyPermissions = Collections.list(staticPolicyPermissionCollection.elements());
          String codeBase = codesource.getLocation().getPath(); // TODO: This should be using the CodeSource itself to compare with existing code sources
          ArrayList<Permission> permissions = getEffectivePermissions(staticPolicyPermissions, codeBase);
  
          for (Permission permission : permissions) {
              effectivePermissions.add(permission);
          }
  
          return effectivePermissions;
      }
docs: Combine the static permissions with the server.xml and permissions.xml permissions, removing any restricted permission.
  This is called back from the dynamic policy to obtain the permissions for the JSP classes.