What works with plugin 1.3 fails with plugin 1.4

Question

Summary: What works under plugin 1.3 doesn't work under plugin 1.4 !!
Background: Weblogic 5.1 server, Verisign certificate signed applet + server certificate,.... The applet need to communicate with servlets and EJB's on the server.
Problem: everything works ok on a plugin 1.3 client - but with plugin 1.4 I get:
java.security.AccessControlException: access denied (java.net.SocketPermission import.toldskat.dk:443 connect,resolve)
java.security.AccessControlException: access denied (java.net.SocketPermission import.toldskat.dk:443 connect,resolve)
     at java.security.AccessControlContext.checkPermission(AccessControlContext.java:270)
....snip....
Checking newsnet: Appearently I'm not alone with this problem.
[email protected] have the same problem, it seems - but his newsnet post has remained unanswed for 4 months - and I cheched with him that he hasn't found a solution
http://groups.google.com/groups?q=sun+plugin+1.4+java.security.AccessControlException&hl=en&lr=&ie=UTF-8&selm=b41a32b9.0208211012.137914c9%40posting.google.com&rnum=3
Some people seem to mean that the security part of plugin 1.4 has been gutted since 1.3. Check:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&threadm=g9k89.2091%24NZ.76299%40bgtnsc05-news.ops.worldnet.att.net&rnum=3&prev=/groups%3Fhl%3Den%26lr%3D%26ie%3DISO-8859-1%26q%3Dsun%2Bplugin%2B1.4%2Bcertificate%2Bproblem
They refere to document:
http://java.sun.com/products/plugin/1.2/docs/nsobjsigning.html#limitation
where it supposedly says that you need to import certificate into the browser before accessing the signed site (this is new, not necessary with plugin 1.3). Tried it quickly - no luck yet.
This is a serious problem to us at a company here in Denmark, running a major EJB solution handling all the country's import. So I (and probably also [email protected] would appreciate an answer.
regards
Stig Valentini
[email protected]

Answer 1

The following examples are for a win 2000 machine, for linux
you have to use alternative paths but I think the commands
are about the same.
The SUN jre doesn't care about IE settings, if an applet is signed it will ask the user "do you trust", if
the user chooses yes or always the applet can do pretty much anything.
Because anybody can sign an applet so it will pop up the do
you trust dialog I prevent this dialog from popping up by
adding the following to the
C:\Program Files\Java\j2re****\lib\security\java.policy
under grant { [/b]
[color red]
permission java.lang.RuntimePermission "usePolicy";
[color]
You now need to set up special permissions for sites that
need it, signed applets get no special treatment since you
specified in the java.policy that policy should allways be
used.
When your applet needs to do something it normally could
not do (applet security) [b]and it needs to do this
when a user clicks on a html button (applet method called
from javascript), than all the signing and policy settings
in the world wouldn't work Unless you grant all permission
to all code.
This is because the Java Plug-in executes methods with
applet sandbox security restrictions.
http://archives.java.sun.com/cgi-bin/wa?A2=ind0404&L=java-security&F=&S=&P=4012
To solve this you can start a new thread that checks ...
times a second if a variable meets certain conditions.
These conditions are changed with public methods called
from JavaScript. When a variable meets certain Conditions
this thread will start the method that will perform
normally restricted tasks.
Here is an example where the applet doesn't work
(the batchfile, html file are OK)
Note that running this code with Mozilla on my w2k machine
crashes Mozilla (not on my Fedora machine)
Batch file to sign the applet: (please note this will
delete some files)
del *.cer
del *.com
del *.jar
del *.class
javac -classpath ".;C:\Program Files\Java\j2re1.4.2_04\lib\plugin.jar" test.java
keytool -genkey -keystore harm.com -keyalg rsa -dname "CN=Harm Meijer, OU=Technology, O=org, L=Amsterdam, ST=, C=NL" -alias harm -validity 3600 -keypass pass -storepass pass
jar cf0 test.jar test.class
jarsigner -keystore harm.com -storepass pass -keypass pass -signedjar sTest.jar test.jar harm
del *.classThe html page:
<DIV id="dvObjectHolder">  </DIV>
<br><br>
<script>
if(window.navigator.appName.toLowerCase().indexOf("netscape")!=-1){ // set object for Netscape:
     document.getElementById('dvObjectHolder').innerHTML = "        <object ID='appletTest1' classid=\"java:test.class\"" +
                "height=\"0\" width=\"0\" onError=\"changeObject();\"" +
          ">" +
                "<param name=\"mayscript\" value=\"Y\">" +
                "<param name=\"archive\" value=\"sTest.jar\">" +
        "</object>";
}else if(window.navigator.appName.toLowerCase().indexOf('internet explorer')!=-1){ //set object for IE
     document.getElementById('dvObjectHolder').innerHTML =      "<object ID='appletTest1' classid=\"clsid:8AD9C840-044E-11D1-B3E9-00805F499D93\"" +
               "         height=\"0\" width=\"0\" >" +
               "   <param name=\"code\" value=\"test.class\" />" +
                  "<param name=\"archive\" value=\"sTest.jar\">" +
               " </object>"
</script>
<LABEL id="lblOutputText">This text will be replaced by the applet</LABEL>
<BR>
<input value="Javascript to java" type=button onClick="document.appletTest1.fromJavaScript()"><br>The applet:
// new class for jsObject!!!! since 1.4.2 compile this:
// javac -classpath "C:\Program Files\Java\j2re1.4.2_01\lib\plugin.jar" test.java
// since jaws.jar does not exsist anymore
// to compile with jaws: javac -classpath "C:\j2sdk1.4.0_03\jre\lib\jaws.jar" test.java
import netscape.javascript.*;
public class test extends java.applet.Applet {
    JSObject win;
    JSObject outputLabel;
    public void init() {
         try{
             win = JSObject.getWindow(this);
             outputLabel = (JSObject) win.eval("document.getElementById('lblOutputText')");
          outputLabel.setMember("innerHTML", "<center><h1>From Init<br>Your homedir " + System.getProperty("user.home") + "</h1></center>");
        }catch(Exception e){
             e.printStackTrace();
    public void fromJavaScript(){
         try{
                 outputLabel.setMember("innerHTML", "<center><h1>From javascript<br>Your homedir: "+ System.getProperty("user.home") + "</h1></center>");
        }catch(Exception e){
             e.printStackTrace();
}When you put the files in c:\temp, run the batch file to
compile and sign the applet and then open the html file you
will be asked if you trust ... you can say yes and from
init the applet can read user.home. Click on the button and
you will get the following stack trace:
java.security.AccessControlException: access denied (java.util.PropertyPermission user.home read)
     at java.security.AccessControlContext.checkPermission(Unknown Source)
     at java.security.AccessController.checkPermission(Unknown Source)
     at java.lang.SecurityManager.checkPermission(Unknown Source)
     at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
     at java.lang.System.getProperty(Unknown Source)
     at test.fromJavaScript(test.java:20)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
     at java.lang.reflect.Method.invoke(Unknown Source)
     at sun.plugin.com.MethodDispatcher.invoke(Unknown Source)
     at sun.plugin.com.DispatchImpl.invokeImpl(Unknown Source)
     at sun.plugin.com.DispatchImpl$2.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at sun.plugin.com.DispatchImpl.invoke(Unknown Source)Conclusion: the applet can read user.home but not from
JavaScript.
Here is the applet that does work because a method called
from javaScript doesn't perform a restricted task.
// new class for jsObject!!!! since 1.4.2 compile this:
// javac -classpath "C:\Program Files\Java\j2re1.4.2_01\lib\plugin.jar" test.java
// since jaws.jar does not exsist anymore
// to compile with jaws: javac -classpath "C:\j2sdk1.4.0_03\jre\lib\jaws.jar" test.java
import netscape.javascript.*;
public class test extends java.applet.Applet {
     JSObject win;
     JSObject outputLabel;
     boolean buttonFromJavaClicked = false;
     checkJavaScriptEvent evt = new checkJavaScriptEvent();
     public void init() {
          try {
               evt.start();
               win = JSObject.getWindow(this);
               outputLabel =
                    (JSObject) win.eval("document.getElementById('lblOutputText')");
               outputLabel.setMember(
                    "innerHTML",
                    "<center><h1>From Init<br>Your homedir "
                         + System.getProperty("user.home")
                         + "</h1></center>");
          } catch (Exception e) {
               e.printStackTrace();
     public void fromJavaScript() {
          buttonFromJavaClicked = true;
     private void fromJavaScript2() {
          System.out.println("fromjavascript2 is started");
          try {
               String strLbl =
                    "<center><h1>From javascript<br>Your homedir: "
                         + System.getProperty("user.home")
                         + "</h1></center>";
               outputLabel.setMember("innerHTML", strLbl);
          } catch (Exception e) {
               e.printStackTrace();
     class checkJavaScriptEvent extends Thread {
          public void run() {
               while (true) {
                    if (test.this.buttonFromJavaClicked) {
                         System.out.println("OK buttonfromjava is true");
                         test.this.buttonFromJavaClicked = false;
                         test.this.fromJavaScript2();
                    try {
                         Thread.sleep(300);
                    } catch (Exception e) {
                         System.out.println("exception in sleep");
                         e.printStackTrace();
                         System.exit(1);
}