202256 - Signed XUL apps cannot run outside of the sandbox

Status: RESOLVED WORKSFORME

(Core :: Security, defect)

Description

[Neil Durant]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3) Gecko/20030312
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3) Gecko/20030312

It appears that Mozilla does not allow a signed XUL that uses java app to run
outside of the sandbox, instead requiring edits to the java.policy file to
slacken the security policy.  Signed java applets can run out of the sandbox, so
why not signed XUL apps?

Reproducible: Always

Steps to Reproduce:
1.Write a XUL app that calls Java methods
2.Package the app into a jar and sign it
3.Attempt to run the app

Actual Results:  
The following java exception was thrown:
java.security.PrivilegedActionException:
java.lang.reflect.InvocationTargetException: java.lang.NoClassDefFoundError


Expected Results:  
The XUL app should have been able to invoke java and operate normally, outside
of the sandbox, in the same way as it does in the sandbox when the java.policy
file is adjusted.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Java has its own security manager and signature verifier, separate from
Mozilla's, so signing XUL/JS code has no effect on privileges granted to applets
or Java methods. You need to sign the applet separately.

Comment 2

[Neil Durant]

However, it appears that Java in a signed jar cannot be called successfully from
XUL/JS (ie via LiveConnect), even though a signed applet can be successfully
invoked from HTML using <applet>.

The problem also remains where there is no Java jar file, and calls are made to
Java SDK methods entirely via LiveConnect.  Mozilla provides no way to sign this
code, allowing it to be distributed and run out of the sandbox, which would be
required if the Java accesses the filesystem, network etc.

Or am I missing something?

Comment 3

[Mitchell Stoltz (not reading bugmail)]

No, you are correct. Java and JS security engines don't talk to each other well.
Unfortunately, to do this right would be a major effort and I don't know who has
the resources for that right now. I'm marking this Future, and helpwanted. If
anyone's interested in working on this, feel free to take the bug.