Where can I find the specification for the Class.getProtectionDomain().getCodeSource() method?

Regardless of whether I use the Oracle JDK, IBM JDK or the Open JDK (all version 8), I'm noticing that the following method is always returning null when the class in question is a JDK library class:

    Class clazz = Integer.class;
    CodeSource codeSource = clazz.getProtectionDomain().getCodeSource(); 

What I would like to know is whether or not the fact that this is null for a set of classes (namely, the classes supplied by the JDK) is specified somewhere (as opposed to it being a commonly-agreed upon value for these classes, decided by the various implementers).

However, I can't seem to find where this would be specified. I've already checked the following sources and have not found any mention there:

• The Java SE 8 JLS
• The Java SE 8 JVM Spec
• JSR-115 (JavaTM Authorization Contract for Containers 1.5)

Where is this behaviour specified? Or is it indeed not specified and a "happy coincidence" that all three JVM implementations have the same behaviour?

(Bonus points if you can explain how this is implicitly specified as a result of other specifications, which I suspect to be the case!)