Using XMLEncoder in Applet causes securityexception

I've written a simple Applet which should be able to XMLEncode a bean and write the XML-code to the standard output. (later it should be expanded to place various beans on a panel and write the XML to the server the applet is placed on, to be able to retrieve it later for further editing, but which is not the point right now)
The problem is when I run it in Internet Explorer or Netscape with Java plug-in 1.4.01, I get 9 times the following security exception before I get the output.
My question is, is there some way to prevent this security exception from occuring?
java.security.AccessControlException: access denied (java.lang.reflect.ReflectPermission suppressAccessChecks)
Continuing ...
<?xml version="1.0" encoding="UTF-8"?>
<java version="1.4.0" class="java.beans.XMLDecoder">
<object class="javax.swing.JButton">
<void property="actionCommand">
<string>Hello, world</string>
</void>
<void property="label">
<string>Hello, world</string>
</void>
<void property="model">
<void property="actionCommand">
<null/>
</void>
</void>
</object>
</java>
I've got this simple code:
public class XMLTest extends javax.swing.JApplet {
public XMLTest() {
public void init() {
java.beans.XMLEncoder xmle = new java.beans.XMLEncoder(System.out);
xmle.writeObject(new javax.swing.JButton("Hello, world"));
xmle.close();
<HTML>
<HEAD>
<TITLE>Applet HTML Page</title>
</head>
<BODY>
<APPLET code="XMLTest.class" width=200 height=100>
</applet>
</body>
</html>

Thanks for the info; if it's really the last opportunity, I'll sign it, but it's not the intention at all to step out of the sandbox. The Applet doesn't need to write to the local file-system, all what it needs to do is read out the parameters of the beans it contains with XMLEncoder and put it in a string so I can send to the server it came from (this is no security issue).
The output XMLEncoder produces after the security exceptions (see the first message) is sufficient, contains enough parameters and can be used well the reverse way with XMLDecoder and without any security exceptions.
My question is this: Is XMLEncoder itself using code which bypasses the sandbox (probably yes) and is there some way to influence the process of encoding so the security exceptions don't occur?

Similar Messages

Is it possible to use JAXP in Applet? Really urgeng.

I need to get String output from a DOM Document using JAXP in Applet. I want the entire XML document in one string .I write the code as following,but it doesn't work. Would you help me to point out the mistake I made in it?
Any help would be appreciated,
Thanks.
import java.awt.*;
import javax.swing.*;
import javax.xml.parsers.*;
import javax.xml.transform.*;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
import org.w3c.dom.*;
import javax.xml.transform.dom.DOMSource;
import java.io.*;
import java.io.IOException;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import java.util.*;
public class XMLTest extends JApplet {
     String str;
     public void init()
     str="hello";
try
DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
DocumentBuilder db =factory.newDocumentBuilder();
Document m_dDoc = db.newDocument();
Element e1=m_dDoc.createElement("first");
Text tx;
tx=m_dDoc.createTextNode("hi");
e1.appendChild(tx);
m_dDoc.appendChild(e1);
DOMSource doms = new DOMSource(m_dDoc);
Writer out = new StringWriter();
StreamResult result = new StreamResult(out);
TransformerFactory tf = TransformerFactory.newInstance();
Transformer transformer = tf.newTransformer();//wrong
transformer.transform(doms,result);
str=result.toString();
catch(Exception e)
e.printStackTrace();
     public void paint(Graphics g)
          g.drawString(str, 50, 60 );
}

The problem is that using the transformer in an applet results in the exception:
The exception is as following:
org.apache.xml.utils.WrappedRuntimeException: Output method is xml could not loa
d output_xml.properties (check CLASSPATH)
at org.apache.xalan.templates.OutputProperties.getDefaultMethodPropertie
s(OutputProperties.java:364)
at org.apache.xalan.templates.OutputProperties.<init>(OutputProperties.j
ava:130)
at org.apache.xalan.transformer.TransformerIdentityImpl.<init>(Transform
erIdentityImpl.java:104)
at org.apache.xalan.processor.TransformerFactoryImpl.newTransformer(Tran
sformerFactoryImpl.java:804)
at XMLTest.init(XMLTest.java:36)
at sun.applet.AppletPanel.run(AppletPanel.java:341)
at java.lang.Thread.run(Thread.java:536)
I am still unclear to the cause, when I create a copy of the output_xml.properties file and put it somewhere in your classpathe (I put mine in a jar that the applet loads) you get:
java.lang.ExceptionInInitializerError
     at java.lang.Class.forName0(Native Method)
     at java.lang.Class.forName(Class.java:140)
     at org.apache.xalan.serialize.SerializerFactory.getSerializer(SerializerFactory.java:131)
     at org.apache.xalan.transformer.TransformerIdentityImpl.createResultContentHandler(TransformerIdentityImpl.java:232)
     at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:296)
     at com.thalesgroup.mss.infrastructure.xml.SOAPMessage.domDocToString(SOAPMessage.java:180)
     at com.thalesgroup.mss.applets.filemanager.XmlMessages.getFileList(XmlMessages.java:246)
     at com.thalesgroup.mss.applets.filemanager.FileManagerFrame.getFileList(FileManagerFrame.java:575)
     at com.thalesgroup.mss.applets.filemanager.FileManagerFrame.access$2(FileManagerFrame.java:29)
     at com.thalesgroup.mss.applets.filemanager.FileManagerFrame$fileList.run(FileManagerFrame.java:847)
Caused by: java.lang.RuntimeException: The resource [ XMLEntities.res ] could not load: java.net.MalformedURLException: no protocol: XMLEntities.res
XMLEntities.res      java.net.MalformedURLException: no protocol: XMLEntities.res
     at org.apache.xalan.serialize.CharInfo.<init>(CharInfo.java:202)
     at org.apache.xalan.serialize.SerializerToXML.<clinit>(SerializerToXML.java:292)
     ... 10 more
Which leads me to some questions:
What is XMLEntities.res, and how do I get one?
Does anyone know which version of Xalan and JAXP comes with J2SE 1.4.1?
Why the package "org.apache.xalan.Version" is not in the J2SE 1.4.1 release (and should it be?)

Applet ServerSocket SecurityException

SecurityExceptionEx[Host]: cannot access 11110
My applet is signed.
I use netscape security:
PrivilegeManager.enablePrivilege("UniversalConnect");
PrivilegeManager.enablePrivilege("UniversalListen");
PrivilegeManager.enablePrivilege("UniversalAccept");
but no use because there is an SecurityException.
Please tell me how can I solve this problem.

Be carefull if you acces the web through a proxy server, that may be a problem 4 the cnx.
Hope to be helpfull, make me know if not
...where Java has never gone before

Can parport be used in a applet?

I have been trying to get parport to read and write in an applet but have had no success. It works fine at the command line but when used in the applet it stops my applet program when it comes to executing the read function.
My first idea was keep the parport read and write codes completely seperate from the applet in their own class file and then call the class file to be run. Is this at all possible?
I have posted the code to see if i can make this clearer
import parport.ParallelPort;
class SimpleIO {
public static void main ( String []args )
ParallelPort lpt1 = new ParallelPort(0x378); // 0x378 is normally the base address for the LPT1 port
int aByte;
aByte = lpt1.read(); // read a byte from the port's STATUS pins
System.out.println("Input from parallel port: " + aByte);
aByte = aByte >> 2; // a simple and irrelevant operation
lpt1.write(aByte); // write a byte to the port's DATA pins
System.out.println("Output to port: " + aByte);
//////////////This code above will be kept in its own java file called SIMPLEIO.java////////
I then want to call and run this code from my applet java file. After some experimenting i think i have found out that you need the
public static void main ( String []args ) line in the parport code in order for it work properly. What code would i use to call and run this code from the applet file
Thx for reading my long post and thx to all who try and help me out

My first idea was keep the parport read and write codes completely seperate from the applet in their
own class file and then call the class file to be run. Is this at all possible?No. The problem is that applets run in what's called a sandbox which prevents them, and any classes called from them, from doing any local IO.
This is essential for security, since a web page can run an applet without the user knowing about it, and it could get up to all kinds of mischief.
You can digitally sign the applet, which will then ask the user for permission to run with reduced restrictions. A quick search of java/sun should turn up some instructions.

Can I Use Jce in applet

Hi all,
Thanks for everybody first if you look at my question and try to help me to find out the problem.
I need to write a applet which can let people to use
the jce's des function to encipher the user's password and
id from the homepage.
I write a applet already. It work fine as a application.
But it doesn't work when I run it as a applet. Does the problem come from the security problem because I need
to Load a sun_jce provider in a clien machine ?
Can I use JCE in applet ?
If it is ok to use jce in developing applet do I need to sign the applet before run it in web and which file I need to sign.
Btw, I use the archive tag in html file to make user get the whole jce jar file. does it Ok.
Followin is my source code
import javax.crypto.*;
import javax.crypto.spec.*;
import java.security.*;
import sun.misc.*;
import java.applet.*;
import java.awt.*;
public class DesApplet extends Applet{
     public static void main(String[] arg) throws Exception{
          DesApplet des = new DesApplet();
          des.CallDes();
     public void init(){
          CallDes();
     public void paint(Graphics g){
     public CallDes(){
          Cipher desCipher;
          int i;
          try{
               Security.addProvider(new com.sun.crypto.provider.SunJCE());
               KeyGenerator keygen = KeyGenerator.getInstance("DES");
               SecretKey desKey = new SecretKeySpec("11111111".getBytes(),"DES");
               System.out.println("Hello");
               desCipher = Cipher.getInstance("DES/ECB/NoPadding");
               desCipher.init(Cipher.ENCRYPT_MODE,desKey);
               byte[] cleartext = "00000000".getBytes();
               String value = convert_int_to_hex(cleartext,8);
               System.out.println("cleartext is:"+value);
               byte[] ciphertext = desCipher.doFinal(cleartext);
               value = convert_int_to_hex(ciphertext,8);
               System.out.println("ciphertext is:"+value);
               desCipher.init(Cipher.DECRYPT_MODE,desKey);
               byte[] cleartext1 = desCipher.doFinal(ciphertext);;
               value = convert_int_to_hex(cleartext1,8);
               System.out.println("cleartext1 is:"+value);
          }catch(Exception e){System.err.println(e);}
     public String convert_int_to_hex(byte[] value, int len) {
     int i;
     int j;
     byte tmp;
     byte[] temp = new byte[len*2];
     char[] chars = new char[len*2];
     String result = new String();
     for (i=0; i<len; i++)
     if (value[i] < 0)
     temp[i*2] = (byte)((value[i] & 0xF0) >>> 4);
     temp[i*2+1] = (byte)(value[i] & 0x0F);
     else
     temp[i*2] = (byte)(value[i] / 16);
     temp[i*2+1] = (byte)(value[i] % 16);
     for (i=0; i<len*2; i++)
     if (temp[i] > 9)
     chars[i] = (char)(temp[i] - 10 + 65);
     else
     chars[i] = (char)(temp[i] + 48);
     result = result.concat(result.valueOf(chars));
     return result;

I have a server and a client.
Server has jdk1.4. client is an applet. I need to encrypt the username and password that are sent from client to the server.
I am able to encrypt and decrypt using JCE's DES on server side, since jdk1.4 has JCE provider installed by default. Since the applet may be running on any browser which may not have JCE supported. Is it possible for me to send the JCE jar file along with the applet and somehow enable the client applet to encrypt the user name and password and send to server.
Thanks a lot,
Gagan.

Using bc4j with applets

Hi,
I was wondering if you have any tips on using bc4j in applets. The 2 biggest problems I'm having is the jar size of the applet after all libs are included
(4MB+) and the fact that I can't use XDK, JNDI, BC4J and some other libs from applets unless I sign them or change the policy file at each client using the applets.
I really think all the calls to System.getProperties(), etc. should be placed inside try catch blocks to catch the security exceptions raised by xdk, RMIInitialContextFactory, etc. and handled using
defaults for properties... it'd be even better if these properties could be set in another way as well.
Thanks in advance,
Leonardo Bueno

FYI... my environment is:
Oracle9iAS (9.0.3.0.0)
JDeveloper (9.0.3.4)

Using javaagents with applets

Is it possible to use javaagents with applets?
If it is, how?

FYI... my environment is:
Oracle9iAS (9.0.3.0.0)
JDeveloper (9.0.3.4)

Why isn't System.exit(0) used from an Applet

I am trying to figure out why the System.exit(0) method isn't used for an applet. Is it because an applet isn't an application (which is why the public static void main(String args[]))?
I have noticed when if I include System.exit(0) I will get an compilation error.
Is there someplace in the Java Tutorial that explains this?
thanks

You can put it in, but if you run it in a browser, it
will kill the browser and all its windowsThat is if the applet is signed. I have also noticed this behaviour and I think it is pretty weird. It looks like a bug to me.

Importing photos to my ipad 2 on iOS 4.3.2 using camera connection kit causes photo app to crash

Importing photos to my ipad 2 on iOS 4.3.2 using camera connection kit causes photo app to crash. Tried importing photo from an iPhone 4/ Panasonic DMC-FX50 via USB and SD card but without success. However, importing video from a Flip Mino HD is ok. Can't seem to figure out what I'm doing wrong

Have you tried a reset by holding the power and home buttons for ten seconds until the apple appears?
Since it's multiple different import devices not working with the CCK, it appears to be on the iPad side...
If the reset doesn't help, try a restore from within iTunes on the computer.

Impact of use XMLEncoder to log transactions that use serialization

Hi,
i have an application that uses serialization to communicate between client and server, i want to log this transactions in a xml file using XMLEncoder, using the method:
public static void log(Object transaction) throws Exception {
        XMLEncoder e = new XMLEncoder(new BufferedOutputStream(new FileOutputStream("log.xml")));
        e.writeObject(transaction);
        e.close();
}if i put this, how i can check the impact on the system? the XMLEncoder consumes memory to build the XML, then the impact will be only for the garbage collector?
thanks for any idea.

A profile would be the best option. NetBeans comes with a free one. There is also OptimizeIt and JProbe. Otherwise you'd have to write a lot of code to get that info.

How to decide if an object was completely encoded using XMLEncoder

Hi, 'completely encoded' means that the object reconstructed from XMLDecoder is equal to the original object. Here is an example class which is not 'completely encoded' (because one of its properties is of type java.awt.geom.Point2D):
public static class SomeBean {
  private Dimension size;
  private Point2D location;
  public Dimension getSize() {
    return size;
  public void setSize(Dimension size) {
    this.size = size;
  public Point2D getLocation() {
    return location;
  public void setLocation(Point2D point) {
    this.location = point;
  public String toString() {
    return getClass().getName() + "[location=" + location +
      ",size=" + size + "]";
here is the corresponding XML representation:
<?xml version="1.0" encoding="UTF-8"?>
<java version="1.5.0_12" class="java.beans.XMLDecoder">
  <object class="XML_Persistence$SomeBean">
    <void property="location">
      <object class="java.awt.geom.Point2D$Float"/>
    </void>
    <void property="size">
      <object class="java.awt.Dimension">
        <int>42</int>
        <int>42</int>
      </object>
    </void>
  </object>
</java>
By printing out the two objects, you can see that they are not equal:
Serializing: XML_Persistence$SomeBean[location=Point2D.Float[42.0, 42.0],size=java.awt.Dimension[width=42,height=42]]
Deserialzed: XML_Persistence$SomeBean[location=Point2D.Float[0.0, 0.0],size=java.awt.Dimension[width=42,height=42]]
It isn't problematic for my app if an object cannot be 'completely encoded', i'm just looking for a reliable way to know.
Thanks, Hans

ejp wrote:
This is very odd. The XMLEncoder already does a trial decode to make sure it has serialized the object.
Doesn't a line like this one
<object class="java.awt.geom.Point2D$Float"/>
indicate that an object (as part of an object graph) was encoded without any additional information?Exactly. But the XMLEncoder assumes wevertying is a Java bean, with getters and setters. Any object without set methods isn't going to be serialized correctly. You need to add your own PersistenceDelegate for any such classes you find.Thanks, ejp - knowing that an object cannot be reconstructed by encoding/decoding it would be sufficient. Currently my strategy is:
a) Encode the object to memory, using XMLEncoder.
b) If no exceptions were thrown, parse the resulting XML for lines of the form "<object ... />". If any such line is found, the object is no candidate for XML-serialization.
c) If the object (or a super-class) overrides Object.equals, the XML is decoded and the resulting object is compared to the original one.

HT3406 i want to use another SIM card cause im in another country now but i cant activate my iphone. Anyone?

i want to use another SIM card cause im in another country now but i cant activate my iphone. Anyone?

The iPhone is most likely locked to the network of the company you purchased the iPhone for. You'll need to contact the mobile provider to unlock it. They are the only one's who can unlock it.

How to show an html page using JEditorPane in applet.

I have never use jeditorpane with applet so i dont know how to show a html page.if you have some code or any example then please posted that.Thanks

public class MyApplet extends JApplet{
    private JTextPane textPane = null;
    public void init(){
    HTMLEditorKit editorKit = new HTMLEditorKit();
    HTMLDocument htmlDoc   = (HTMLDocument)editorKit.createDefaultDocument();
    textPane = new JTextPane();
    textPane.setEditable(false);
    textPane.setEditorKit(editorKit);
    textPane.setContentType("text/html");
    textPane.setDocument(htmlDoc);
    Container c = getContentPane();
    c.add(new JScrollPane(textPane),    BorderLayout.CENTER);
    c.add(buttonPanel,                  BorderLayout.SOUTH);
    c.add(Box.createVerticalStrut(5),   BorderLayout.NORTH);
    c.add(Box.createHorizontalStrut(5), BorderLayout.EAST);
    c.add(Box.createHorizontalStrut(5), BorderLayout.WEST);
    public void setHtml(String html){
        // you should check the textpane's document to detrmine if there
        // is already text in there..if so, then clear the textpane text and then
        // set the new html...Note: JTextPane only show basic Html ..
        // not like a full blown browser
        textPane.setTextt(html);
        textPane.setCaretPosition(0);
}

Using JMF with applet

Hello,
I've got an applet that consumes a lot of CPU. I'm studying to migrate this applet to a pda, but it's not enough cpu for it. I'm reading JMF docs and I decide to generate a movie with the output of an applet. �If it's possible? My idea is to create the movie on the server. I can modify my applet to avoid the use of the applet inheritance and then render the output to an standard movie format. After I will send the movie to the browser
You can see the applet here. Click on View route 3D under the flash movie.
http://www.tmb.net/vullanar/en_US/resultatcerca.jsp?tipusrepre=0&origenx=31514.420&origeny=82758.000&descripcioorigen=L1+-ARCDE+TRIOMF&destix=34704.550&destiy=87378.460&descripciodesti=L2+-ARTIGUES-SANTADRI%C0&tipustransport=0&numtransbords=2&tempscaminant=20&velocitatcaminant=1&tipushora=1&dia=27&mes=05&hora=12&minut=22&idioma=en_US&operador=TMB&poblacioorigen=1&poblaciodesti=1
Thanks in advance,
David B.

passionforjava2 wrote:
...I have issues with applet unable to transmit voice using JMF. i know it is a security issue. As the error on the console says
java.lang.RuntimeException: No permission to capture from applets
Error : Couldn't create DataSourceWhen JMF is installed, it generally offers a checkbox to allow or deny 'capture in applet'. By default it is not checked, and if the user goes with that recommendation, I am not sure that anything will overrule that.
In a folder iPhone/myphone/What is the URL where we can visit this applet?
.. i have applet embedded html file along with .jar files with required classed and applet signed. Are you prompted to trust the digitally signed code? You can see the dialog I mean by visiting the applet linked from [http://pscode.org/test/docload/].
..Along with that .jar i do have jmf.jar and java.policy.applet file and jmf.properties file . Forget the policy files, they are a waste of time, and completely impractical for end users.

Using a java applet as form

hi there,
I'm new to programming applets (but not new to java and gui programming).
Here's my question:
I would like to use a java applet with a textfield as form input. is this possible?
I see some several advantages over using standard html textfields and java script. (f.e.: I can set the cursor to any position after changing the text in the field).
I'm thinking on a solution by my own. Would it be possible to use a java script method to access a property from the applet? so I could use a combination of java applet, html and java script. On the onClick() event I read the actual value from the applet and do some normal post request. Any better suggestions?
thx
soa

I want to write the textfield in java. So I use the applet as form.
What would be your suggestion?
Write an applet with an textfield and and getValue() method? So I could create a normal html button and use javascript to write a method wich acces this getmethod. So I could register this method to the onClick() event.

Using XMLEncoder in Applet causes securityexception

Similar Messages

Maybe you are looking for