This discussion is archived
9 Replies Latest reply: Aug 25, 2011 2:27 AM by 884082 RSS

Upgrade to JDK 1.6.0_24 introduced Security Exception

821960 Newbie
Currently Being Moderated
I have a signed applet that was working fine before upgrading to JDK 1.6.0_24.

Here's the code that causes the exception:
AppletContext ac = this.getAppletContext();
URL doc = new URL("file", "", filename);
ac.showDocument(doc, "_blank");
filename is a string containing the fully qualified path to a MS Office document.

Before upgrading this would activate the proper piece of MS Office and display the document.
Now I get the following exception:
java.lang.SecurityException: showDocument url permission denied
sun.plugin2.main.client.MessagePassingExecutionContext.showDocument(Unknown Source)
sun.plugin2.applet.Plugin2Manager$AppletContextImpl.showDocument(Unknown Source)
....
Is there something new I need to do to get this capability working again within the confines of what Security will allow a signed Applet to do?

Edited by: TPL86 on Apr 18, 2011 1:19 PM
  • 1. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    456795 Newbie
    Currently Being Moderated
    Update 24 introduced a lot of regression bugs when it comes to signed applets and permissions. I encountered it with JFileChooser. Try wrapping your code with:


    AccessController.doPrivileged(new PrivilegedAction() {
    
       public Object run() {
           //your code here that throws a security exception.
       }
    );
  • 2. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    821960 Newbie
    Currently Being Moderated
    Thank you for the reply.

    I tried what you suggested, but alas it still gave me the "SecurityException: showDocument url permission denied".
    final AppletContext ac = this.getAppletContext();
    final URL doc = new URL("file", "", filename);
    AccessController.doPrivileged(
        new PrivilegedAction() {
            public Object run() {
                ac.showDocument(doc, "_blank");
                return null;
            }
        }
    );
    Any other suggestions as to what I might try?

    Edited by: TPL86 on Apr 18, 2011 1:20 PM
  • 3. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    456795 Newbie
    Currently Being Moderated
    I think your previous working code is now considered a security problem. It is discussed as well as the problem I had with JFileChooser in thread Getting access denied java.io.FilePermission since update 24 In your case it looks like since update 24 you can't load and run an applet and its resources from both the local file system and the internet. See http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7020285 and the unrelated JFileChooser permission problem is reported as a bug: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7036025
  • 4. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    821960 Newbie
    Currently Being Moderated
    (sigh) I thought the purpose of getting a Verisign certificate and signing the applet was to allow things like this. I guess ORACLE thinks differently. Caffeine - Thanks for your input.
  • 5. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    884082 Newbie
    Currently Being Moderated
    Hi Caffeine,

    Did you manage to run JFileChooser successfully? We are still struggling with it. I wrapped JFileChooser creation code into doPriviledge, but it still does not work. The dialog appears, but users cannot change folders or select files.
         AccessController.doPrivileged(new PrivilegedAction<Object>() {
              @Override
              public Object run() {
                   fileChooser = new JFileChooser();
                   return null;
              }               
         });
    fileChooser.showOpenDialog(this);
    Also, when I try to wrap the showOpenDialog() method, I am getting the following compilation error message:

    "The method showOpenDialog(Component) in the type JFileChooser is not applicable for the arguments (new PrivilegedAction<Object>(){})"

         
                AccessController.doPrivileged(new PrivilegedAction<Object>() {
                   @Override
                   public Object run() {
                        fileChooser = new JFileChooser();
                        fileChooser.showOpenDialog(this);
                        return null;
                   }               
              });
            
    The above code snippets are in the signed applet in a method which is invoked from JavaScript.

    Edited by: user12293393 on Aug 23, 2011 8:24 AM
  • 6. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    sabre150 Expert
    Currently Being Moderated
    user12293393 wrote:
    "The method showOpenDialog(Component) in the type JFileChooser is not applicable for the arguments (new PrivilegedAction<Object>(){})"

         
                AccessController.doPrivileged(new PrivilegedAction<Object>() {
                   @Override
                   public Object run() {
                        fileChooser = new JFileChooser();
                        fileChooser.showOpenDialog(this);
                        return null;
                   }               
              });
    The above code snippets are in the signed applet in a method which is invoked from JavaScript.
    Of course that won't compile! This is nothing special to Applets whether signed or unsigned and shows that you need to spend more time with your Java tutorial.

    The showOpenDialog() method requires as argument an object derived from java.awt.Component but by using 'this' you provide an instance of the the anonymous inner class PrivilegedAction<Object> which most definitely is not a java.awt.Component. Since I can't see the whole of your code I can't be certain but if the parent class is derived from java.awt.Component or one of it's sub-classes you need to provide the parent class 'this' and not the inner class 'this'. One normally does this by using 'WhateverYourParentClassNameIs.this' rather than 'this' .
  • 7. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    884082 Newbie
    Currently Being Moderated
    Hi sabre150,

    Yes, I took obvious mistake here. I wish you never been in a situation that leads mistakes like this.

    Thank you, now the JFileChooser is working again in the signed applet even with Java 6 update 25 that client is using. :)

    Have a really nice day!
  • 8. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    sabre150 Expert
    Currently Being Moderated
    user12293393 wrote:
    Yes, I took obvious mistake here. I wish you never been in a situation that leads mistakes like this.
    Do I detect a hint of sarcasm here? I have made similar mistakes but it would seem that the difference between you and I is that when I have a compilation error I assume that it is my code that is wrong and not a bug in the compiler.
  • 9. Re: Upgrade to JDK 1.6.0_24 introduced Security Exception
    884082 Newbie
    Currently Being Moderated
    Hey, nothing offense from my side.

    I did not think that the error is with the compiler but that I am missing something obvious in my hurry and was sure in that a 'third eye' can detect it fast.

    So, thank you again!

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 5 points