366538 - JavaWebStart 5 and security

Status: RESOLVED INACTIVE

(Rhino Graveyard :: Core, defect, P5)

Description

[Petr Ferschmann]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; cs-CZ; rv:1.8.1.1) Gecko/20060601 Firefox/2.0.0.1 (Ubuntu-edgy)
Build Identifier: 1.6R2

When running under under JavaWebStart 5 (6 is working well), the script has less privileges than when runned without JavaWebStart:

When I run following code (methow work()) with false it throws AccessControlException (but when not called from JavaScript the same code works well). When I call it with true it works well. In JNLP file there is <all-permissions/>.

 public static class DummySm extends SecurityManager {
                public void checkPermission(Permission perm, Object context) {
                }
                public void checkPermission(Permission perm) {
                }
        }

        public void delej() throws IOException {
                InputStream in = new URL("http://localhost:8080/").openStream();

                Scanner sc = new Scanner(in);
                System.out.println(sc.nextLine());
        }

        public static void work(boolean useSm) throws IOException {
        SecurityManager sm = System.getSecurityManager();
        try {
                if (useSm) {
                        System.setSecurityManager(new DummySm());
                }

                App app = new App();
                app.delej();

                Context cx = Context.enter();
                Scriptable scope = cx.initStandardObjects();

                Object jsAction = Context.javaToJS(app, scope);
                ScriptableObject.putProperty(scope, "app", jsAction);

                cx.evaluateString(scope, "app.delej();", "", 0, null);
                Context.exit();
        } finally {
                System.setSecurityManager(sm);
        }

        }


Reproducible: Always

Steps to Reproduce:
See details.
Actual Results:  
Exception is thrown:

 java.security.AccessControlException: access denied (java.net.SocketPermission 10.0.0.109:11998 connect,resolve)

Expected Results:  
No AccessControlException.

I will attach whole project to test it.

Comment 1

[Petr Ferschmann]

Attachment: Whole project to verify it (uses maven2)

Comment 2

[Norris Boyd]

Low priority, particularly given it works in JavaWebStart 6.

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Closing. Bug management is now done here:
https://github.com/mozilla/rhino