Closed Bug 519734 Opened 10 years ago Closed 7 years ago

Blocklist Apple's "Java Applet.plugin" (their ancient Java 1.3.1 plugin)

Categories

(Toolkit :: Blocklist Policy Requests, defect)

PowerPC
macOS
defect
Not set

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: smichaud, Unassigned)

Details

Apple's ancient Java 1.3.1 plugin (Java Applet.plugin) is still
present on PPC Macs running OS X 10.4.X (and possibly 10.5.X).  It
hasn't been updated in many years, and is presumably full of security
holes.

The Java Embedding Plugin (and the OJI infrastructure it uses) has
been removed from the trunk (mozilla-central, Minefield) and the 1.9.2
branch (Namoroka, FF 3.6).  Current trunk builds will no longer run on
OS X 10.4.X, so this isn't a problem on trunk.  But current 1.9.2
branch builds still run on OS X 10.4.X.  If you try to open a Java
applet in one of these builds, it will currently load and use Java
Applet.plugin.

No-one should currently be using Apple's Java Applet.plugin.  So I
think that all versions of it should be blocklisted on the 1.9.2
branch.

At bug 517355 I'm working on a patch to restore OJI, Liveconnect and
the JEP on the 1.9.2 branch.  Currently my patch doesn't work properly
on PPC Macs, because Java Applet.plugin gets loaded instead of the
JEP.  I'll try to figure out why that's happening and fix it.  But
even after my patch has been changed to avoid this problem, the Java
Applet.plugin will still get used if someone disables the JEP (now
that there's no longer a global disable/enable-Java setting, see bug
506985).  I think we need to forestall this possibility by
blocklisting the Java Applet.plugin.
> Current trunk builds will no longer run on OS X 10.4.X, so this
> isn't a problem on trunk.

Oops.  If Java Applet.plugin is still present on OS X 10.5.X on PPC
Macs (perhaps upgraded from 10.4.X), this *is* a problem on the trunk.

Marcia, do you still have a PPC Mac running OS X 10.5.X?  If so, could
you check for a Java Applet.plugin in its /Library/Internet Plug-Ins/
directory?
It's not possible to block a specific JRE version -- the java plugin has independent version information and I don't think we have the ability to tie the two together.

CANTFIX
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WONTFIX
But you *can* blocklist a plugin by name, can't you?
Morgamic says yes, so reopening.
Status: RESOLVED → REOPENED
Resolution: WONTFIX → ---
Tell me what you want to block and we can do it.
Summary: Blocklist Apple's Java Applet.plugin (their ancient Java 1.3.1 plugin) → Blocklist Apple's "Java Applet.plugin" (their ancient Java 1.3.1 plugin)
Looks like we need to just block by the filename: "Java Applet.plugin" -- yay or
nay?
> Looks like we need to just block by the filename: "Java Applet.plugin"

Correct.
Ok.
Assignee: nobody → morgamic
Status: REOPENED → ASSIGNED
Assignee: morgamic → nobody
Is blocklisting still a option here ?
This is a mass change. Every comment has "assigned-to-new" in it.

I didn't look through the bugs, so I'm sorry if I change a bug which shouldn't be changed. But I guess these bugs are just bugs that were once assigned and people forgot to change the Status back when unassigning.
Status: ASSIGNED → NEW
Closing old blocklist bugs. Please reopen if the problem still exists.
Status: NEW → RESOLVED
Closed: 10 years ago7 years ago
Resolution: --- → WONTFIX
This blocklisting request became obsolete when we dropped support for OS X 10.5.
Resolution: WONTFIX → WORKSFORME
Product: addons.mozilla.org → Toolkit
You need to log in before you can comment on or make changes to this bug.