安全性：Japplet中的访问被拒绝异常

Question

这个小程序直到昨天都工作良好，现在给了我一些例外。 这是堆栈跟踪：

java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "getenv.localappdata")
Exception in thread "AWT-EventQueue-1" java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "modifyThreadGroup")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)
    at java.security.AccessController.checkPermission(AccessController.java:560)
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
    at sun.applet.AppletSecurity.checkAccess(AppletSecurity.java:252)
    at java.lang.ThreadGroup.checkAccess(ThreadGroup.java:315)
    at java.lang.Thread.init(Thread.java:376)
    at java.lang.Thread.<init>(Thread.java:485)
    at javax.swing.plaf.basic.BasicDirectoryModel$LoadFilesThread.<init>(BasicDirectoryModel.java:222)
    at javax.swing.plaf.basic.BasicDirectoryModel.validateFileCache(BasicDirectoryModel.java:140)
    at javax.swing.plaf.basic.BasicDirectoryModel.propertyChange(BasicDirectoryModel.java:69)
    at java.beans.PropertyChangeSupport.fire(PropertyChangeSupport.java:335)
    at java.beans.PropertyChangeSupport.firePropertyChange(PropertyChangeSupport.java:327)
    at java.beans.PropertyChangeSupport.firePropertyChange(PropertyChangeSupport.java:263)
    at java.awt.Component.firePropertyChange(Component.java:8382)
    at javax.swing.JFileChooser.setCurrentDirectory(JFileChooser.java:581)
    at javax.swing.JFileChooser.<init>(JFileChooser.java:344)
    at javax.swing.JFileChooser.<init>(JFileChooser.java:296)
    at gui1.jButton1ActionPerformed(gui1.java:148)
    at gui1.access$000(gui1.java:21)
    at gui1$1.actionPerformed(gui1.java:62)
    at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:2018)
    at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2341)
    at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:402)
    at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:259)
    at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:252)
    at java.awt.Component.processMouseEvent(Component.java:6505)
    at javax.swing.JComponent.processMouseEvent(JComponent.java:3321)
    at java.awt.Component.processEvent(Component.java:6270)
    at java.awt.Container.processEvent(Container.java:2229)
    at java.awt.Component.dispatchEventImpl(Component.java:4861)
    at java.awt.Container.dispatchEventImpl(Container.java:2287)
    at java.awt.Component.dispatchEvent(Component.java:4687)
    at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4832)
    at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4492)
    at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4422)
    at java.awt.Container.dispatchEventImpl(Container.java:2273)
    at java.awt.Component.dispatchEvent(Component.java:4687)
    at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:729)
    at java.awt.EventQueue.access$200(EventQueue.java:103)
    at java.awt.EventQueue$3.run(EventQueue.java:688)
    at java.awt.EventQueue$3.run(EventQueue.java:686)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:76)
    at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:87)
    at java.awt.EventQueue$4.run(EventQueue.java:702)
    at java.awt.EventQueue$4.run(EventQueue.java:700)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:76)
    at java.awt.EventQueue.dispatchEvent(EventQueue.java:699)
    at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:242)
    at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:161)
    at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:150)
    at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:146)
    at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:138)
    at java.awt.EventDispatchThread.run(EventDispatchThread.java:91)
BUILD SUCCESSFUL (total time: 34 seconds)

我还创建了一个策略文件，并将其放在名为.java.policy的user.home目录中。

grant {
  permission java.io.FilePermission "<<ALL FILES>>", "write";
  permission java.lang.RuntimePermission "getenv.<environment variable name>";
  permission java.io.FilePermission "<<ALL FILES>>", "read";
  permission java.io.FilePermission "<<ALL FILES>>", "delete";
};

这是小程序代码

/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
import javax.swing.JApplet;
import javax.swing.SwingUtilities;
import java.io.File;
import java.io.IOException;
/*
<applet code="mainapplet.java" width=500 height=500>
</applet>
*/
/**
 *
 * @author sabertooth
 */
public class mainapplet extends JApplet {

    /**
     * Initialization method that will be called after the applet is loaded
     * into the browser.
     */
    private String localappfolder;
    private String topath;

    public void init() {
        // TODO start asynchronous download of heavy resources
        try{
            localappfolder=System.getenv("localappdata");
            topath=localappfolder+"\\ossoc\\";
            new File(topath).mkdir();

        }
        catch(Exception e)
        {
            System.out.println(e);
        }
        try {
            SwingUtilities.invokeAndWait(new Runnable() {

                public void run() {
                    createGUI();
                }
            });
        } catch (Exception e) { 
            System.err.println("createGUI didn't complete successfully");
        }

    }
    public void destroy(){


    }
    // TODO overwrite start(), stop() and destroy() methods
    private void createGUI(){
        gui1 gui1=new gui1();
        gui1.setOpaque(true);
        setContentPane(gui1);
    }
     private static void deleteDir(File dir)
    throws IOException
  {
    if (!dir.isDirectory()) {
      throw new IOException("Not a directory " + dir);
    }



    dir.delete();
  }

}

Answer 1

请在Applet jar上签名并在代码中使用它。 策略文件不是解决访问问题的理想解决方案。