Java Applet with jar embed in HTML security issue

Question

I embed an applet to a HTML page. The applet also uses the MySQL jar file.

It works just fine without the MySQL jar file. When executing it from the local webserver or hosted webserver it gives the following error:

Exception in thread "AWT-EventQueue-2" java.lang.ExceptionInInitializerError
at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:286)
at java.sql.DriverManager.getConnection(Unknown Source)
.........
Caused by: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "file.encoding" "read")
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)

My File list:

/appletTest.html
/mysql-connector-java-5.1.18-bin.jar
/applet/testApplet.class

testApplet.class:

package applet;

import java.applet.Applet;
import java.awt.Graphics;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class HelloWorldApplet extends Applet {

@Override
public void paint(Graphics g) {
    g.drawString("Hello World", 25, 50);

    Connection con = null;
    Statement st = null;
    ResultSet rs = null;

    String url = "jdbc:mysql://localhost:3306/testdb";

    try {
        con = DriverManager.getConnection(url, "root", ""); // <= here fails
        st = con.createStatement();
        rs = st.executeQuery("SELECT VERSION()");

        if (rs.next()) {
            g.drawString(rs.getString(1), 25, 50);
        }

    } catch (SQLException ex) {
        System.out.println(ex);
    } 
  }
}

appletTest.html:

<html>
  <head>
  <title>Applet Test</title>
  </head>
   <body>
      <applet code="applet.testApplet.class" width="500" height="300" archive="mysql-connector-java-5.1.18-bin.jar">
      </applet>
   </body>
</html>

I assume that this security error comes because an applet cannot access to local resources unless you 'sign it' or 'change the local security policy'. But all my files are located on the webserver and the applet requests the jar file which is also located on the webserver.

So, I don't see here a local file request but still get this error. Could you please give me any suggestions?

Jean-Philippe Leclerc · Accepted Answer · 2013-02-25 18:53:56Z

1

"Ordinarily, unsigned Java applets or applications may only connect back to the web server from which they originated. This restriction prevents an applet from causing denial-of-service attacks by making rapid connections to arbitrary machines on the Internet."

When you are testing, ensure that you are on the same domain as the webserver. file:///.../appletTest.html won't work even if you are accessing localhost.

That line: String url = "jdbc:mysql://localhost:3306/testdb"; will need to change to the address of your webserver.

[EDIT] And isn't is silly to open a new connection every time paint() is called?

[EDIT] I read your post more carefully. The problem is that you can't access the jar file. The easiest way is to package your driver in the same jar as your applet.

edited Feb 25, 2013 at 18:53

answered Feb 25, 2013 at 18:43

Jean-Philippe Leclerc

6,8055 gold badges45 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Korki Korkig Over a year ago

@JeanP In this case I don't think that the url is important because it fails before loads but thank you for pointing it. I've also tried to changing it but this also didn't work by the way.

Korki Korkig Over a year ago

@JeanP PS: paint() method and the all coding was just an example to picture it;)

Korki Korkig Over a year ago

@JeanP I've packaged the library and the class in the same jar. Removed all files. I have now two files "applet/test.jar and "appletTest.html". It gives still the same error. My current html code <applet code="applet.testApplet" width="500" height="300" archive="applet/test.jar"></applet>

Collectives™ on Stack Overflow

Java Applet with jar embed in HTML security issue

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related