519734 - Blocklist Apple's "Java Applet.plugin" (their ancient Java 1.3.1 plugin)

Status: RESOLVED WORKSFORME

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Steven Michaud [:smichaud] (Retired)]

Apple's ancient Java 1.3.1 plugin (Java Applet.plugin) is still
present on PPC Macs running OS X 10.4.X (and possibly 10.5.X).  It
hasn't been updated in many years, and is presumably full of security
holes.

The Java Embedding Plugin (and the OJI infrastructure it uses) has
been removed from the trunk (mozilla-central, Minefield) and the 1.9.2
branch (Namoroka, FF 3.6).  Current trunk builds will no longer run on
OS X 10.4.X, so this isn't a problem on trunk.  But current 1.9.2
branch builds still run on OS X 10.4.X.  If you try to open a Java
applet in one of these builds, it will currently load and use Java
Applet.plugin.

No-one should currently be using Apple's Java Applet.plugin.  So I
think that all versions of it should be blocklisted on the 1.9.2
branch.

At bug 517355 I'm working on a patch to restore OJI, Liveconnect and
the JEP on the 1.9.2 branch.  Currently my patch doesn't work properly
on PPC Macs, because Java Applet.plugin gets loaded instead of the
JEP.  I'll try to figure out why that's happening and fix it.  But
even after my patch has been changed to avoid this problem, the Java
Applet.plugin will still get used if someone disables the JEP (now
that there's no longer a global disable/enable-Java setting, see bug
506985).  I think we need to forestall this possibility by
blocklisting the Java Applet.plugin.

Comment 1

[Steven Michaud [:smichaud] (Retired)]

> Current trunk builds will no longer run on OS X 10.4.X, so this
> isn't a problem on trunk.

Oops.  If Java Applet.plugin is still present on OS X 10.5.X on PPC
Macs (perhaps upgraded from 10.4.X), this *is* a problem on the trunk.

Marcia, do you still have a PPC Mac running OS X 10.5.X?  If so, could
you check for a Java Applet.plugin in its /Library/Internet Plug-Ins/
directory?

Comment 2

[Michael Morgan [:morgamic]]

It's not possible to block a specific JRE version -- the java plugin has independent version information and I don't think we have the ability to tie the two together.

CANTFIX

Comment 3

[Steven Michaud [:smichaud] (Retired)]

But you *can* blocklist a plugin by name, can't you?

Comment 4

[Samuel Sidler (old account; do not CC)]

Morgamic says yes, so reopening.

Comment 5

[Michael Morgan [:morgamic]]

Tell me what you want to block and we can do it.

Comment 6

[Michael Morgan [:morgamic]]

Looks like we need to just block by the filename: "Java Applet.plugin" -- yay or
nay?

Comment 7

[Steven Michaud [:smichaud] (Retired)]

> Looks like we need to just block by the filename: "Java Applet.plugin"

Correct.

Comment 8

[Michael Morgan [:morgamic]]

Ok.

Comment 9

[Carsten Book [:Tomcat]]

Is blocklisting still a option here ?

Comment 10

[Michael Kohler [:mkohler]]

This is a mass change. Every comment has "assigned-to-new" in it.

I didn't look through the bugs, so I'm sorry if I change a bug which shouldn't be changed. But I guess these bugs are just bugs that were once assigned and people forgot to change the Status back when unassigning.

Comment 11

[Jorge Villalobos [:jorgev] (he/him)]

Closing old blocklist bugs. Please reopen if the problem still exists.

Comment 12

[Steven Michaud [:smichaud] (Retired)]

This blocklisting request became obsolete when we dropped support for OS X 10.5.