如何避免applet“你想运行这个应用程序吗？”弹出消息

Question

Recently we had to upgrade to Java JRE to 1.8.0_201 for an old web application using a single signed Applet. Since then, on starting the applet the "Do you want to run this application?" pop-up window is shown with the detailed information "This application will run with unrestricted access which may put your computer and personal information at risk. Run this application if you trust the location and publisher above."

According to this oracle article this is caused because the manifest does not contain the Permissions attribute. Validation shows that the MANIFEST.MF does contain the attribute.

Manifest-Version: 1.0
Application-Name: MyApplet
Implementation-Title: My Applet
Svn-Url: 
Job-Name: 
Implementation-Version: 3.12.0-SNAPSHOT
Build-Number: 
Archiver-Version: Plexus Archiver
Built-By: username
Implementation-Vendor-Id: nl.myorg.myapplet
Application-Library-Allowable-Codebase: *.myorg.nl       
 localhost
  127.0.0.1
Implementation-Vendor: My Organisation
Build-Tag: 3.12.0-SNAPSHOT
Caller-Allowable-Codebase: *.myorg.nl localhost 127.0.0.1
Permissions: sandbox
Codebase: *.myorg.nl               localhost 127.0.0.1
Svn-Revision-LastChange: 
Created-By: Apache Maven 3.1.1
Build-Jdk: 1.8.0_171
Svn-Revision: 

I think this issue is related to Java Applet & Web Start - Code Signing . So i tried to run the applet in a sandbox to prevent the asking users for full permissions.

I added the <Permissions>sandbox</Permissions> entry to the applets manifest.

Changed the security settings in the applets jnlp from

  <security>
    <all-permissions/>
  </security>

to

  <security>
    <j2ee-application-client-permissions />
  </security>

And added <PARAM name=permissions value=sandbox> to the <applet></applet> .

After making these changes a pop-up is shown with 'ExitException: The Java security settings have prevented this application from running. You may change this behaviour in the Java Control Panel.'.

The Java Console does give some more details;

cache: Create from verifier: JarSigningData{hasOnlySignedEntries=true, hasSingleCodeSource=true, hasMissingSignedEntries=false}
java.lang.SecurityException: JAR manifest requested to run in sandbox only: http://localhost:8080/MyApplet/static/3.12.0-SNAPSHOT/applets/MyApplet.jar
    at com.sun.deploy.security.DeployManifestChecker.verify(Unknown Source)
    at com.sun.deploy.security.DeployManifestChecker.verify(Unknown Source)
    at com.sun.javaws.security.AppPolicy.grantUnrestrictedAccess(Unknown Source)
    at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResourcesHelper(Unknown Source)
    at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResources(Unknown Source)
    at sun.plugin2.applet.JNLP2Manager.prepareLaunchFile(Unknown Source)
    at sun.plugin2.applet.JNLP2Manager.loadJarFiles(Unknown Source)
    at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
basic: The Java security settings have prevented this application from running. You may change this behavior in the Java Control Panel.
basic: Dialog type is not candidate for embedding

Since the exception is thrown by DeployManifestChecker.verify could it be that there is an error in the jnlp file ? If so how to determine what is wrong?

Answer 1

Solution is by storing the public key of the applet certificate on a very specific way into the java trusted.certs in the user directory. The trusted.certs is located in \\Users{username}\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security.

The certificate has to be loaded similar to the instruction below

"\Program Files\Java\jre1.8.0_201\bin\keytool.exe" -import -alias deploymentusercert$tsflag$loc=http//localhost:8080##jnlp:http//localhost:8080##docbase:http//localhost:8080##from:http//localhost:8080java.util.random@1dc6cb9 -file D:\Desktop\APP-CERT.csr -keystore trusted.certs

The alias seems to be mis-used to store the associated location of the site and jnlp. The alias must have a heading of "deploymentusercert$tsflag$" and a java instance reference to java.util.random as tail text. Inbetween the properties loc, jnlp, docbase and from have to be specified, where the separator between loc and the value is '=' and for the others ':'.

Only issue is that the keystore created through the Java Control Panel has no password. When there is no existing trusted.certs before adding the applets certificate, you will have to write a small Java application or use another tool than keytool to create the keystore. This because keytool does not allow you to create a keystore without a password. Or you could make the world a little bit safer by using a password protected java truststore :-D.