Java Security AccessControlException in Applet

Question

I'm running into an issue with my applet. It's supposed to take a url and parse the html there to construct an image. I've gotten it to work on my eclipse debugger. However, when I try to use it on a web browser I get an AccessControlException. I'm using the jEditorPane.setPage(url) method. Currently both the applet and url are hosted on my localhost and I did self sign the applet.

java.lang.RuntimeException: java.security.AccessControlException: access denied (java.net.SocketPermission 127.0.0.1:80 connect,resolve)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getHeaderField(Unknown Source)
    at java.net.HttpURLConnection.getResponseCode(Unknown Source)
    at javax.swing.JEditorPane.getStream(Unknown Source)
    at javax.swing.JEditorPane.setPage(Unknown Source)
    at javax.swing.JEditorPane.setPage(Unknown Source)
    at com.mindbody.printer.PrinterApplet.print(PrinterApplet.java:24)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at sun.plugin.javascript.JSInvoke.invoke(Unknown Source)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at sun.plugin.javascript.JSClassLoader.invoke(Unknown Source)
    at sun.plugin2.liveconnect.JavaClass$MethodInfo.invoke(Unknown Source)
    at sun.plugin2.liveconnect.JavaClass$MemberBundle.invoke(Unknown Source)
    at sun.plugin2.liveconnect.JavaClass.invoke0(Unknown Source)
    at sun.plugin2.liveconnect.JavaClass.invoke(Unknown Source)
    at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$DefaultInvocationDelegate.invoke(Unknown Source)
    at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$3.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo.doObjectOp(Unknown Source)
    at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$LiveConnectWorker.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)

Answer 1

An unsigned applet is only allowed to connect to the host it came from. And even for signed applets, in methods invoked from code less trusted (like the javascript code here), it has only the rights of this code (or more exactly, the intersection of all rights).

To be able to do everything for which your applet has the rights, wrap your rights-needing code with AccessController.doPrivileged(...) . (But make sure that this can not do dangerous things when given malicious arguments from outside.)