applet security problem アップレットの安全

2005-09-18 00:05:31 | Weblog

Hi everyone, My question is applet capable of reading some files located in server where this applet is located without digital signature? I know it is not possible for applet to access client local files, but how about server ?
THANK YOU in advance!


RE:

The applet can access the server that it came from without any additional signing or other security tweaking.


thank you , but ...
Author: wolf2006 Sep 17, 2005 2:30 AM (reply 2 of 5)


thank you so much for your reply!
But I still got some seriours problems , here are some of my codes, my IDE is eclipse3.0 with a tomcat plugin, and I put a test.txt file into the same folder as the class file(what I want to do is read the contents in the test.txt file and print it in the applet), at last I run this machine as a server(address is http://192.168.1.3:8080"), and try to access the page from another machine.
public class TestApplet extends Applet{

StringBuffer sb ;
public void init() {
sb = new StringBuffer();
}
public void start() {
try {
FileReader fr = new FileReader(getCodeBase().toString()+"test.txt");
int c ;
while ((c=fr.read())!=-1){
sb.append(c);
}
} catch (FileNotFoundException e) {
e.printStackTrace();
} catch (IOException e1) {
e1.printStackTrace();
}
repaint();
}
public void paint(Graphics g){
g.drawString(sb.toString(),100,100);
}
}
and when I access the html page which embeds the class file of this applet , I got the error message below

java.security.AccessControlException: access denied (java.io.FilePermission http:192.168.1.3:8080someprojectclassestest.txt read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkRead(Unknown Source)
at java.io.FileInputStream.<init>(Unknown Source)
at java.io.FileInputStream.<init>(Unknown Source)
at java.io.FileReader.<init>(Unknown Source)
at TestApplet.start(TestApplet.java:23)
at sun.applet.AppletPanel.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

P.S.
below is the HTML code I made :
<html>
<head>
</head>
<body>
<applet code="TestApplet" width="500" height="500">
</applet>


This example demonstrates TestApplet!!!



</body>
</html>

Re: thank you , but ...


That's because you're using a FileReader, which is used for reading off the local filesystem.

Use Resources.
http://java.sun.com/j2se/1.4.2/docs/guide/resources/index.html


Re: thank you , but ...
Author: wolf2006 Sep 17, 2005 7:09 AM (reply 4 of 5)


hi paulcw , Thank you so much for your great advice , it really helped. I did what you told me, and it worked!! thank you so much . But In fact , above is just a simple sample of What I want to do. My real objective is to develop a applet that use a package named JWNL which is a JAVA interface to access WordNet(a semantic English dictionary). I have suceede to develop a application , and now in order to make it possible for user to access it for web , I want to make the application an applet . And before useing JWNL, I have to initialize it at first, something like JWNL.initialize(propertiesStream), and of course the property files are all located in server. When I access mypage , I always got the AccessControlException , So I want to ask a question : Is there no way for me to use this package through Applet , Except I rewrite the core code of this package(that seems to be a quite big job)?Maybe this question should not be asked here , but if you have some similar experiences ... Thank you again for your great help!!


Re: thank you , but ...


I'm not familiar with that package. There's no reason offhand why you shouldn't be able to access something from the same server the applet comes from. So I'm wondering what you're actually trying to do instead. If you post the stack trace you're getting that might help. Or maybe you should ask other users of the package; perhaps there's a forum about it on the site that distributes it.


Thank you very much ,
I tried again to clear the problem , but failed...
What I did with JWNL package is just called initialize method, and below is my code
InputStream s = Class.forName("TestApplet").getResourceAsStream(URL);
JWNL.initialize(s);
and error occured in JWNL.initialize(s), stack trace shows :
net.didion.jwnl.JWNLException: Unable to install net.didion.jwnl.dictionary.FileBackedDictionary
.......
Caused by: java.security.AccessControlException: access denied (java.io.FilePermission c:\program files\wordnet\2.0\dict\adv.idx read)

at java.security.AccessControlContext.checkPermission(AccessControlContext.java:284)


at java.security.AccessController.checkPermission(AccessController.java:415)

at java.lang.SecurityManager.checkPermission(SecurityManager.java:554)

at java.lang.SecurityManager.checkRead(SecurityManager.java:899)

at java.io.RandomAccessFile.<init>(RandomAccessFile.java:216)

at net.didion.jwnl.princeton.file.PrincetonRandomAccessDictionaryFile.openFile(PrincetonRandomAccessDictionaryFile.java:76)


at net.didion.jwnl.dictionary.file.AbstractDictionaryFile.open(AbstractDictionaryFile.java:58)


at net.didion.jwnl.dictionary.file.DictionaryCatalog.open(DictionaryCatalog.java:46)


at net.didion.jwnl.dictionary.file.DictionaryCatalogSet.open(DictionaryCatalogSet.java:34)


at net.didion.jwnl.dictionary.file_manager.FileManagerImpl.<init>(FileManagerImpl.java:54)


at net.didion.jwnl.dictionary.file_manager.FileManagerImpl.create(FileManagerImpl.java:69)


at net.didion.jwnl.util.factory.AbstractValueParam.create(AbstractValueParam.java:32)

because I didn't do anything inside initialize() method and either didn't set anywhere in my code " c:\program files\wordnet\2.0\dict\adv.idx ", so I think maybe this is a bug in the core of this package make it not possible be used with applet, anyway I will do more research with this package.
Thank you so much for your great kindness !!