在 HTML 中部署具有安全权限的 Java 小程序

Question

我很难让它发挥作用。

小程序嵌入在我的web page 中，它正在尝试连接到 Java Servlet here。

在某些计算机上连接正常，在其他计算机上出现无法连接错误，我认为这是由 java 安全权限引起的。

自定义1：拒绝访问（java.net.SocketPermission 184.91.186.5:8080 connect,resolve）

java.security.AccessControlException: access denied (java.net.SocketPermission 184.91.186.5:8080 connect,resolve)
    at java.security.AccessControlContext.checkPermission(Unknown Source)
    at java.security.AccessController.checkPermission(Unknown Source)
    at java.lang.SecurityManager.checkPermission(Unknown Source)
    at java.lang.SecurityManager.checkConnect(Unknown Source)
    at sun.plugin2.applet.Applet2SecurityManager.checkConnect(Unknown Source)
    at java.net.Socket.connect(Unknown Source)
    at sun.net.NetworkClient.doConnect(Unknown Source)
    at sun.net.www.http.HttpClient.openServer(Unknown Source)
    at sun.net.www.http.HttpClient.openServer(Unknown Source)
    at sun.net.www.http.HttpClient.<init>(Unknown Source)
    at sun.net.www.http.HttpClient.New(Unknown Source)
    at sun.net.www.http.HttpClient.New(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.connect(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source)
    at Calendar_Algorithm$Con.send_courses_to_server(Calendar_Algorithm.java:789)
    at Calendar_Algorithm$Con.run(Calendar_Algorithm.java:773)
    at Calendar_Algorithm.send_courses_to_server(Calendar_Algorithm.java:761)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at sun.plugin.javascript.JSInvoke.invoke(Unknown Source)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at sun.plugin.javascript.JSClassLoader.invoke(Unknown Source)
    at sun.plugin2.liveconnect.JavaClass$MethodInfo.invoke(Unknown Source)
    at sun.plugin2.liveconnect.JavaClass$MemberBundle.invoke(Unknown Source)
    at sun.plugin2.liveconnect.JavaClass.invoke0(Unknown Source)
    at sun.plugin2.liveconnect.JavaClass.invoke(Unknown Source)
    at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$DefaultInvocationDelegate.invoke(Unknown Source)
    at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$3.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo.doObjectOp(Unknown Source)
    at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$LiveConnectWorker.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)

我已经签署了 jar 文件，但仍然无法解决问题。 这是我生成密钥文件并签署 jar 的方式。

keytool -genkey -alias cal -keystore keys  -keypass #### -dname "cn=feldman" -storepass ####

jarsigner -keystore keys -storepass #### -keypass #### -signedjar CalSigned.jar Cal.jar cal

这是我将它嵌入到 html 页面的方式：

<script src="http://java.com/js/deployJava.js"></script>

    <script>
        var attributes = {code:'Calendar_Algorithm.class',
                      archive:'Cal39.jar',
                      width:150, height:50,
                      id:"ClientApp",
                      name:"ClientApp"
                      } ;
        var parameters = {fontSize:16} ;
        var version = '1.6' ;
        deployJava.runApplet(attributes, parameters, version);
    </script>

我也试过做一个 jnlp 文件，但我什至无法启动 jar，这是我的 jnlp 文件内容：

  <?xml version="1.0" encoding="utf-8"?>
<jnlp spec="1.5+" codebase="" href="">
    <security>
        <all-permissions/>
    </security>
    <information>
        <title>Easy Course Selector</title> 
        <vendor>Group Boba</vendor>
        <homepage href="index.html"/>
        <description>Easy Course Selector</description>
        <description kind="short">Easy Course Selector</description>
        <icon href="mouseguard-small-jpg3.jpg"/>

    </information>

    <resources>
        <j2se version="1.5+" href="http://java.sun.com/products/autodl/j2se" />
        <jar href="Cal.jar" main="true" download="eager" />
    </resources>
    <applet-desc name="EasyCourse Applet" main-class="Calendar_Algorithm.class" width="200" height="50">
    </applet-desc>
    <update check="background"/>
</jnlp> 

以及嵌入代码

<script> 
    var attributes = {id:"ClientApp", name:"ClientApp", code:'Calendar_Algorithm',   width:150, height:50} ; 
    var parameters = {jnlp_href: 'Cal_Info.jnlp'} ; 
    deployJava.runApplet(attributes, parameters, '1.6'); 
</script>

这是我使用它连接外部服务器时的错误日志：

java.security.AccessControlException: access denied (java.net.SocketPermission 184.91.186.5:8080 connect,resolve)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkConnect(Unknown Source)
at sun.plugin2.applet.Applet2SecurityManager.checkConnect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at sun.net.NetworkClient.doConnect(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.http.HttpClient.<init>(Unknown Source)
at sun.net.www.http.HttpClient.New(Unknown Source)
at sun.net.www.http.HttpClient.New(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source)
at Calendar_Algorithm$Con.send_courses_to_server(Calendar_Algorithm.java:789)
at Calendar_Algorithm$Con.run(Calendar_Algorithm.java:773)
at Calendar_Algorithm.send_courses_to_server(Calendar_Algorithm.java:761)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at sun.plugin.javascript.JSInvoke.invoke(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at sun.plugin.javascript.JSClassLoader.invoke(Unknown Source)
at sun.plugin2.liveconnect.JavaClass$MethodInfo.invoke(Unknown Source)
at sun.plugin2.liveconnect.JavaClass$MemberBundle.invoke(Unknown Source)
at sun.plugin2.liveconnect.JavaClass.invoke0(Unknown Source)
at sun.plugin2.liveconnect.JavaClass.invoke(Unknown Source)
at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$DefaultInvocationDelegate.invoke(Unknown Source)
at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$3.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo.doObjectOp(Unknown Source)
at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$LiveConnectWorker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

任何帮助都会很棒。

这里也是导致错误的代码：

class Con implements PrivilegedExceptionAction<Boolean> {
    private final String text;
    boolean res;
    public Con(String t) {
      text=t;
    }

    public Boolean run() { 
      res=send_courses_to_server();
      return res;
    } 
    public boolean send_courses_to_server(){

        try {
            URL url = new URL(server);

            HttpURLConnection con;
            con=(HttpURLConnection) url.openConnection();
            con.setRequestProperty("Content-type", "text/xml; charset=UTF-8");
            con.setRequestMethod("POST");
            con.setDoOutput(true);
            con.setDoInput(true);


            OutputStream out = con.getOutputStream();
            Writer writer = new OutputStreamWriter(out, "UTF-8");
            String xml="";
            writer.write("<Request>\n" +"<Request_Type>Validation_2</Request_Type>\n");
            xml="<Request>\n" +"<Request_Type>Validation_2</Request_Type>\n";



            Scanner in=new Scanner(text);
            while(in.hasNext()){
                String temp=in.nextLine().trim();
                writer.write("<Course>"+temp+"</Course>\n");
                xml=xml+"<Course>"+temp+"</Course>\n";
            }
            writer.write("</Request>\n");
            xml=xml+"</Request>\n";

            writer.flush();
            writer.close();

            InputStream is= con.getInputStream();

            if(con.getContentType().equals("text/xml")){
                status_message= new Scanner(is).nextLine();
                return false;
            }
            else{
                return set_courses(is);
            }

        } catch (Exception e){
            e.printStackTrace();
            status_message= "Custom 1: "+e.getMessage();
            return false;
        }

    }

    private boolean set_courses(InputStream is){
        courses=new Vector<Course>();

        try {
            ObjectInputStream ois=new ObjectInputStream(is);

            Course c;
            while(true){
                try{
                    c=(Course)ois.readObject();
                    courses.add(c);
                }catch(EOFException e){
                    break;
                }
            }
            ois.close();
        } catch (Exception e){
            status_message= "Custom 3 "+e.getMessage();
            return false;
        }
        status_message="Good";
        return true;
    }

}

Answer 1

现在，通过堆栈跟踪，我们可以更好地了解原因。

...
at Calendar_Algorithm$Con.send_courses_to_server(Calendar_Algorithm.java:789)
at Calendar_Algorithm$Con.run(Calendar_Algorithm.java:773)
at Calendar_Algorithm.send_courses_to_server(Calendar_Algorithm.java:761)
...
at sun.plugin.javascript.JSInvoke.invoke(Unknown Source)
...

您似乎正在使用 JavaScript 来调用您的小程序的方法。您的CalendarAlgorithm 类的send_courses_to_server 方法是从JavaScript 调用的，并直接调用您的Con 内部类的run 方法。这意味着您的代码（仅）使用外部 JavaScript 的权限运行，而不是您的小程序的权限。

Con 类扩展了PrivilegedExceptionAction，但仅此还不足以提供特权执行。您还必须将其包装在对 AccessController.doPrivileged(...) 的调用中（这里给出您的 Con 对象）。

然后将使用通过签名授予您的小程序的权限调用该方法。 （当然，您应该在此之前检查此调用是否合法且没有任何恶意。）

我想你的签名工作，我没有检查这个，因为我通常使用未签名的小程序。顺便说一句，如果您的小程序与 servlet 来自同一台服务器，则此连接不需要任何签名。