Problem loading jar into Applet

Question

Good day folks.
The scenario I try to implement is the following: I want to start an applet A (a small one) which then loads another jar B (a big one) and starts it.
The code of applet A looks like this:
File file = new File("C:\\B.jar");
JarFile jar = new JarFile(file);
String mainclass = jar.getManifest().getMainAttributes().getValue("Main-Class");
URL urlList[] = {file.toURL()};
URLClassLoader loader = new URLClassLoader(urlList,  Thread.currentThread().getContextClassLoader());
Class c = Class.forName(mainclass, true, loader);
MySecondApplet b = ((MySecondApplet ) c.newInstance());Now this works quite well, as long as B doesnt do any potential unsecure stuff like accessing System.Properties. If B tries that I get an java.security.AccessControlException: access denied!
This behaviour is normal if B isn't signed, but both jars A and B are signed with the same signature, so somehow the signature of B isnt looked at by the JavaVM.
Anyone knows why the signature of B is disregarded?
Thanks in advance
MVeeck

Answer 1

First of all, I really don't understand how you manage to create a new Instance of a class
from A that is not in the classpath of A.
My example above I had test and t.
When I try this
((t) c.newInstance()).init();
In test without having t.jar in the html I get the following exception:
ava.lang.NoClassDefFoundError: t
This is because test doesn't know about t because it is not in test's classpath (archive
tag in html file).
Now I can cast t to Applet and get the following exception (same as yours)
AccessControlException: access denied (java.util.PropertyPermission user.name read)
Now I sign t.class differently that test.class and put t.jar back in the html (archive tag).
The jre will ask me twice if I trust the applet because t.jar is signed diffently than test.
That doesn't work hower because I get the following exception:
class "t"'s signer information does not match signer information of other classes in the same package
so I put t in another package and we are back to accessControlException, the jre
never asks the user if he or she trusts t.t class when the t.jar is loaded.
In my opinion this is a bug or if we are missing something here it's poorly
documentend by the jave doc since I found no method at all where I either tell the
JarFile instance or URLClassLoader to ask the user the "do you trust" question.
Here are the files again (changed some code there)
c:\temp\page.htm
<DIV id="lblOutputText">Output comes here</DIV>
<DIV id="dvObjectHolder">Applet comes here</DIV>
<script>
if(window.navigator.appName.toLowerCase().indexOf("netscape")!=-1){ // set object for Netscape:
     document.getElementById('dvObjectHolder').innerHTML = "        <object ID='appletTest1' classid=\"java:test\"" +
                "height='0' width='0' onError=\"changeObject();\"" +
          ">" +
                "<param name=\"archive\" value=\"sTest.jar \">" +
                "<param name=\"mayscript\" value=\"Y\">" +
        "</object>";
}else if(window.navigator.appName.toLowerCase().indexOf('internet explorer')!=-1){ //set object for IE
     document.getElementById('dvObjectHolder').innerHTML =      "<object ID='appletTest1' classid=\"clsid:8AD9C840-044E-11D1-B3E9-00805F499D93\"" +
               "         height='0' width='0' >" +
               "   <param name=\"code\" value=\"test\" />" +
                  "<param name=\"archive\" value=\"sTest.jar\">" +
               " </object>"
</script>c:\temp\t\t.java
package t;
import java.security.*;
import java.io.*;
public class t extends java.applet.Applet {
    public void init() {
         try{
               String user = (String) AccessController.doPrivileged(
                 new PrivilegedAction() {
                    public Object run() {
                         String u = "";
                         try{
                              u = System.getProperty("user.name");
                              File f = new File("C:\\temp\\atest.txt");
                              FileOutputStream fo = new FileOutputStream(f);
                              fo.write("this seems to work\n".getBytes());
                              fo.write("full control here\n".getBytes());
                              fo.write(new String("can allso get the user name:" + System.getProperty("user.name")).getBytes());
                              fo.close();
                         }catch(Exception e){
                              e.printStackTrace();
                         return u;
               System.out.println(user);
        }catch(Exception e){
             e.printStackTrace();
}c:\temp\test.java
import java.net.*;
import java.util.jar.*;
import java.io.*;
public class test extends java.applet.Applet {
    public void init() {
         try{
               File file = new File("C:\\temp\\t.jar");
               JarFile jar = new JarFile(file,true);
               URL urlList[] = {file.toURL()};
               URLClassLoader loader = new URLClassLoader(urlList, Thread.currentThread().getContextClassLoader());
               Class c = Class.forName("t.t", true, loader);
               System.out.println(c==null);
               ((java.applet.Applet) c.newInstance()).init();
        }catch(Exception e){
             e.printStackTrace();
}c:\temp\make.bat
del *.cer
del *.com
del *.jar
del *.class
javac t\t.java
javac test.java
keytool -genkey -keystore harm.com -keyalg rsa -dname "CN=Harm Meijer, OU=Technology, O=org, L=Amsterdam, ST=, C=NL" -alias harm -validity 3600 -keypass password -storepass password
keytool -genkey -keystore har.com -keyalg rsa -dname "CN=Har Meijer, OU=Technology, O=org, L=Amsterdam, ST=, C=NL" -alias har -validity 3600 -keypass password -storepass password
jar cf0 test.jar test.class
jar cf0 tt.jar t\t.class t\t$1.class
jarsigner -keystore harm.com -storepass password -keypass password -signedjar sTest.jar test.jar harm
jarsigner -keystore har.com -storepass password -keypass password -signedjar t.jar tt.jar har
del *.class
del test.jar
del tt.jar
pause