[RFC] netx: show security dialogs in a separate AppContext
Omair Majid
omajid at redhat.com
Wed Oct 20 11:09:34 PDT 2010
Hi,
On 10/19/2010 06:38 PM, Deepak Bhole wrote:
> * Omair Majid<omajid at redhat.com> [2010-10-19 12:10]:
>> Hi,
>>
>> The attached patch makes security prompts appear in a separate
>> AppContext. This ensures that the applet's look and feel is not
>> automatically set to the system look and feel.
>>
>> The patch is a superset of http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2010-October/010500.html
>>
>> This patch also implements a large part of the code necessary to
>> allow applets to access their EventQueues. However, I still have to
>> figure out how to use
>> http://hg.openjdk.java.net/jdk7/awt/jdk/rev/8022709a306d to ensure
>> allowing access to the EventQueue is safe. So for now, that code is
>> disabled.
>>
>> The patch ensures that the JNLPRuntime is always initialized in the
>> main AppContext. It starts a thread in this AppContext to listen for
>> security dialog messages, and shows security dialogs when it
>> receives an appropriate security message. The security dialogs block
>> the client applet/application until the user responds.
>>
>> Any thoughts or comments?
>>
>
> Hi,
>
> Please see comments below.
>
Thanks for the review and the comments. Updated patch attached.
> Cheers,
> Deepak
>
>> Thanks,
>> Omair
>
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/NetxPanel.java
>> --- a/netx/net/sourceforge/jnlp/NetxPanel.java Mon Oct 18 21:29:09 2010 +0100
>> +++ b/netx/net/sourceforge/jnlp/NetxPanel.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -83,19 +83,6 @@
>> getHeight(),
>> atts);
>>
>> - synchronized(JNLPRuntime.initMutex) {
>> - //The custom NetX Policy and SecurityManager are set here.
>> - if (!JNLPRuntime.isInitialized()) {
>> - if (JNLPRuntime.isDebug())
>> - System.out.println("initializing JNLPRuntime...");
>> -
>> - JNLPRuntime.initialize(false);
>> - } else {
>> - if (JNLPRuntime.isDebug())
>> - System.out.println("JNLPRuntime already initialized");
>> - }
>> - }
>> -
>> doInit = true;
>> dispatchAppletEvent(APPLET_LOADING, null);
>> status = APPLET_LOAD;
>> @@ -145,6 +132,19 @@
>> */
>> // Reminder: Relax visibility in sun.applet.AppletPanel
>> protected synchronized void createAppletThread() {
>> + synchronized(JNLPRuntime.initMutex) {
>> + //The custom NetX Policy and SecurityManager are set here.
>> + if (!JNLPRuntime.isInitialized()) {
>> + if (JNLPRuntime.isDebug())
>> + System.out.println("initializing JNLPRuntime...");
>> +
>> + JNLPRuntime.initialize(false);
>> + } else {
>> + if (JNLPRuntime.isDebug())
>> + System.out.println("JNLPRuntime already initialized");
>> + }
>> + }
>> +
>> // when this was being done (incorrectly) in Launcher, the call was
>> // new AppThreadGroup(mainGroup, file.getTitle());
>> ThreadGroup tg = new AppThreadGroup(Launcher.mainGroup,
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/runtime/ApplicationInstance.java
>> --- a/netx/net/sourceforge/jnlp/runtime/ApplicationInstance.java Mon Oct 18 21:29:09 2010 +0100
>> +++ b/netx/net/sourceforge/jnlp/runtime/ApplicationInstance.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -35,7 +35,7 @@
>> import net.sourceforge.jnlp.ShortcutDesc;
>> import net.sourceforge.jnlp.event.ApplicationEvent;
>> import net.sourceforge.jnlp.event.ApplicationListener;
>> -import net.sourceforge.jnlp.security.SecurityWarningDialog.AccessType;
>> +import net.sourceforge.jnlp.security.AccessType;
>> import net.sourceforge.jnlp.services.ServiceUtil;
>> import net.sourceforge.jnlp.util.WeakList;
>> import net.sourceforge.jnlp.util.XDesktopEntry;
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
>> --- a/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java Mon Oct 18 21:29:09 2010 +0100
>> +++ b/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -57,7 +57,8 @@
>> import net.sourceforge.jnlp.cache.CacheUtil;
>> import net.sourceforge.jnlp.cache.ResourceTracker;
>> import net.sourceforge.jnlp.cache.UpdatePolicy;
>> -import net.sourceforge.jnlp.security.SecurityWarningDialog;
>> +import net.sourceforge.jnlp.security.SecurityWarning;
>> +import net.sourceforge.jnlp.security.AccessType;
>> import net.sourceforge.jnlp.tools.JarSigner;
>> import sun.misc.JarIndex;
>>
>> @@ -254,7 +255,7 @@
>>
>> if (extLoader != null&& extLoader != loader) {
>> if (loader.signing&& !extLoader.signing)
>> - if (!SecurityWarningDialog.showNotAllSignedWarningDialog(file))
>> + if (!SecurityWarning.showNotAllSignedWarningDialog(file))
>> throw new LaunchException(file, null, R("LSFatal"), R("LCClient"), R("LSignedAppJarUsingUnsignedJar"), R("LSignedAppJarUsingUnsignedJarInfo"));
>>
>> loader.merge(extLoader);
>> @@ -401,7 +402,7 @@
>> signing = true;
>>
>> if (!js.allJarsSigned()&&
>> - !SecurityWarningDialog.showNotAllSignedWarningDialog(file))
>> + !SecurityWarning.showNotAllSignedWarningDialog(file))
>> throw new LaunchException(file, null, R("LSFatal"), R("LCClient"), R("LSignedAppJarUsingUnsignedJar"), R("LSignedAppJarUsingUnsignedJarInfo"));
>>
>>
>> @@ -455,19 +456,19 @@
>>
>> private void checkTrustWithUser(JarSigner js) throws LaunchException {
>> if (!js.getRootInCacerts()) { //root cert is not in cacerts
>> - boolean b = SecurityWarningDialog.showCertWarningDialog(
>> - SecurityWarningDialog.AccessType.UNVERIFIED, file, js);
>> + boolean b = SecurityWarning.showCertWarningDialog(
>> + AccessType.UNVERIFIED, file, js);
>> if (!b)
>> throw new LaunchException(null, null, R("LSFatal"),
>> R("LCLaunching"), R("LNotVerified"), "");
>> } else if (js.getRootInCacerts()) { //root cert is in cacerts
>> boolean b = false;
>> if (js.noSigningIssues())
>> - b = SecurityWarningDialog.showCertWarningDialog(
>> - SecurityWarningDialog.AccessType.VERIFIED, file, js);
>> + b = SecurityWarning.showCertWarningDialog(
>> + AccessType.VERIFIED, file, js);
>> else if (!js.noSigningIssues())
>> - b = SecurityWarningDialog.showCertWarningDialog(
>> - SecurityWarningDialog.AccessType.SIGNING_ERROR, file, js);
>> + b = SecurityWarning.showCertWarningDialog(
>> + AccessType.SIGNING_ERROR, file, js);
>> if (!b)
>> throw new LaunchException(null, null, R("LSFatal"),
>> R("LCLaunching"), R("LCancelOnUserRequest"), "");
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/runtime/JNLPRuntime.java
>> --- a/netx/net/sourceforge/jnlp/runtime/JNLPRuntime.java Mon Oct 18 21:29:09 2010 +0100
>> +++ b/netx/net/sourceforge/jnlp/runtime/JNLPRuntime.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -25,9 +25,11 @@
>> import java.util.List;
>> import java.security.*;
>> import javax.jnlp.*;
>> +import javax.swing.UIManager;
>>
>> import net.sourceforge.jnlp.*;
>> import net.sourceforge.jnlp.cache.*;
>> +import net.sourceforge.jnlp.security.SecurityDialogMessageHandler;
>> import net.sourceforge.jnlp.services.*;
>> import net.sourceforge.jnlp.util.*;
>>
>> @@ -63,6 +65,9 @@
>> /** the security policy */
>> private static JNLPPolicy policy;
>>
>> + /** handles all security message to show appropriate security dialogs */
>> + private static SecurityDialogMessageHandler securityDialogMessageHandler;
>> +
>> /** the base dir for cache, etc */
>> private static File baseDir;
>>
>> @@ -165,6 +170,8 @@
>> * security manager and security policy, initializing the JNLP
>> * standard services, etc.<p>
>> *
>> + * This method should be called from the main AppContext/Thread.<p>
>> + *
>> * This method cannot be called more than once. Once
>> * initialized, methods that alter the runtime can only be
>> * called by the exit class.<p>
>> @@ -206,15 +213,39 @@
>> policy = new JNLPPolicy();
>> security = new JNLPSecurityManager(); // side effect: create JWindow
>>
>> + try {
>> + UIManager.setLookAndFeel(UIManager.getSystemLookAndFeelClassName());
>> + } catch (Exception e) {
>> + // ignore it
>> + }
>> +
>> if (securityEnabled) {
>> Policy.setPolicy(policy); // do first b/c our SM blocks setPolicy
>> System.setSecurityManager(security);
>> }
>>
>> + securityDialogMessageHandler = startSecurityThreads();
>> +
>> initialized = true;
>> }
>>
>> /**
>> + * This must NOT be called form the application ThreadGroup. An application
>> + * can inject events into its {@link EventQueue} and bypass the security
>> + * dialogs.
>> + *
>> + * @return a {@link SecurityDialogMessageHandler} that can be used to post
>> + * security messages
>> + */
>> + private static SecurityDialogMessageHandler startSecurityThreads() {
>> + ThreadGroup securityThreadGroup = new ThreadGroup("NetxSecurityThreadGroup");
>> + SecurityDialogMessageHandler runner = new SecurityDialogMessageHandler();
>> + Thread securityThread = new Thread(securityThreadGroup, runner, "NetxSecurityThread");
>> + securityThread.start();
>> + return runner;
>> + }
>> +
>> + /**
>> * Returns true if a webstart application has been initialized, and false
>> * for a plugin applet.
>> */
>> @@ -321,6 +352,20 @@
>> }
>>
>> /**
>> + *
>> + * @return the {@link SecurityDialogMessageHandler} that should be used to
>> + * post security dialog messages
>> + */
>> + public static SecurityDialogMessageHandler getSecurityDialogHandler() {
>> + SecurityManager sm = System.getSecurityManager();
>> + if (sm != null) {
>> + // TODO might want to reduce the permission required
>> + sm.checkPermission(new AllPermission());
>> + }
>> + return securityDialogMessageHandler;
>> + }
>> +
>
> No need for the TODO there. The code should be fully trusted. The only
> partially trusted code here would be jnlp apps with j2ee permissions and
> what not, and those should not have access to the dialog.
>
Sure. Fixed.
>> + /**
>> * Returns the system default base dir for or if not set,
>> * prompts the user for the location.
>> *
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/runtime/JNLPSecurityManager.java
>> --- a/netx/net/sourceforge/jnlp/runtime/JNLPSecurityManager.java Mon Oct 18 21:29:09 2010 +0100
>> +++ b/netx/net/sourceforge/jnlp/runtime/JNLPSecurityManager.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -34,7 +34,7 @@
>> import javax.swing.JWindow;
>>
>> import net.sourceforge.jnlp.JNLPFile;
>> -import net.sourceforge.jnlp.security.SecurityWarningDialog;
>> +import net.sourceforge.jnlp.security.AccessType;
>> import net.sourceforge.jnlp.services.ServiceUtil;
>> import net.sourceforge.jnlp.util.WeakList;
>> import sun.awt.AWTSecurityManager;
>> @@ -392,7 +392,7 @@
>> ApplicationInstance app = getApplication();
>> if (app != null&& !app.isSigned()) {
>> if (perm instanceof SocketPermission
>> -&& ServiceUtil.checkAccess(SecurityWarningDialog.AccessType.NETWORK, perm.getName())) {
>> +&& ServiceUtil.checkAccess(AccessType.NETWORK, perm.getName())) {
>> return true;
>> }
>> }
>> @@ -434,7 +434,7 @@
>> Window w = (Window) window;
>>
>> if (JNLPRuntime.isDebug())
>> - System.err.println("SM: app: "+app.getTitle()+" is adding a window: "+window);
>> + System.err.println("SM: app: "+app.getTitle()+" is adding a window: "+window+" with appContext"+AppContext.getAppContext());
>
> Just a minor nitpick .. there should be a space between appContext and
> the ending quotation mark.
>
Fixed.
>>
>> weakWindows.add(window); // for mapping window -> app
>> weakApplications.add(app);
>> @@ -538,4 +538,31 @@
>>
>> }
>>
>> + /**
>> + * Tests if a client can get access to the AWT event queue. This version allows
>> + * complete access to the EventQueue for its own AppContext-specific EventQueue.
>> + *
>> + * FIXME there are probably huge security implications for this. Eg:
>> + * http://hg.openjdk.java.net/jdk7/awt/jdk/rev/8022709a306d
>> + *
>> + * @exception SecurityException if the caller does not have
>> + * permission to accesss the AWT event queue.
>> + */
>> + public void checkAwtEventQueueAccess() {
>> + /*
>> + * this is the templace of the code that should allow applets access to
>> + * eventqueues
>> + */
>> +
>> + // AppContext appContext = AppContext.getAppContext();
>> + // ApplicationInstance instance = getApplication();
>> +
>> + // if ((appContext == mainAppContext)&& (instance != null)) {
>> + // If we're about to allow access to the main EventQueue,
>> + // and anything untrusted is on the class context stack,
>> + // disallow access.
>> + super.checkAwtEventQueueAccess();
>> + // }
>> + }
>> +
>
> As per your original email, I assume this is the part where access is
> completely disabled for now.
>
Yup. checkAwtEventQueueAccess() is called by
Toolkit.getSystemEventQueue() to allow or disallow access to the
Awt/Swing EventQueue. The current implementation delegates to
SecurityManager, which checks if the calling code has
CHECK_AWT_EVENTQUEUE_PERMISSION. Uncommenting the code would allow
applets/applications to access their own EventQueue. Accessing the
EventQueue associated with the main AppContext (which shows the security
dialogs) still delegates to parent.
>> }
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/security/AccessType.java
>> --- /dev/null Thu Jan 01 00:00:00 1970 +0000
>> +++ b/netx/net/sourceforge/jnlp/security/AccessType.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -0,0 +1,53 @@
>> +/* AccessType.java
>> + Copyright (C) 2010 Red Hat, Inc.
>> +
>> +This file is part of IcedTea.
>> +
>> +IcedTea is free software; you can redistribute it and/or
>> +modify it under the terms of the GNU General Public License as published by
>> +the Free Software Foundation, version 2.
>> +
>> +IcedTea is distributed in the hope that it will be useful,
>> +but WITHOUT ANY WARRANTY; without even the implied warranty of
>> +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
>> +General Public License for more details.
>> +
>> +You should have received a copy of the GNU General Public License
>> +along with IcedTea; see the file COPYING. If not, write to
>> +the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
>> +02110-1301 USA.
>> +
>> +Linking this library statically or dynamically with other modules is
>> +making a combined work based on this library. Thus, the terms and
>> +conditions of the GNU General Public License cover the whole
>> +combination.
>> +
>> +As a special exception, the copyright holders of this library give you
>> +permission to link this library with independent modules to produce an
>> +executable, regardless of the license terms of these independent
>> +modules, and to copy and distribute the resulting executable under
>> +terms of your choice, provided that you also meet, for each linked
>> +independent module, the terms and conditions of the license of that
>> +module. An independent module is a module which is not derived from
>> +or based on this library. If you modify this library, you may extend
>> +this exception to your version of the library, but you are not
>> +obligated to do so. If you do not wish to do so, delete this
>> +exception statement from your version.
>> +*/
>> +
>> +package net.sourceforge.jnlp.security;
>> +
>> +/** The types of access which may need user permission. */
>> +public enum AccessType {
>> + READ_FILE,
>> + WRITE_FILE,
>> + CREATE_DESTKOP_SHORTCUT,
>> + CLIPBOARD_READ,
>> + CLIPBOARD_WRITE,
>> + PRINTER,
>> + NETWORK,
>> + VERIFIED,
>> + UNVERIFIED,
>> + NOTALLSIGNED,
>> + SIGNING_ERROR
>> +}
>
> Is there a reason this enum needs its own class? I understand the need
> to need to remove it out of SecurityWarningDialog.. perhaps it should
> reside in the new SecurityWarning class?
>
I just wasnt sure where to place it. I have moved it to SecurityWarning
as you suggested.
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/security/AccessWarningPane.java
>> --- a/netx/net/sourceforge/jnlp/security/AccessWarningPane.java Mon Oct 18 21:29:09 2010 +0100
>> +++ b/netx/net/sourceforge/jnlp/security/AccessWarningPane.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -56,6 +56,7 @@
>> import javax.swing.SwingConstants;
>>
>> import net.sourceforge.jnlp.JNLPFile;
>> +import net.sourceforge.jnlp.security.AccessType;
>> import net.sourceforge.jnlp.util.FileUtils;
>>
>> /**
>> @@ -86,7 +87,7 @@
>> * Creates the actual GUI components, and adds it to this panel
>> */
>> private void addComponents() {
>> - SecurityWarningDialog.AccessType type = parent.getAccessType();
>> + AccessType type = parent.getAccessType();
>> JNLPFile file = parent.getFile();
>>
>> String name = "";
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/security/CertWarningPane.java
>> --- a/netx/net/sourceforge/jnlp/security/CertWarningPane.java Mon Oct 18 21:29:09 2010 +0100
>> +++ b/netx/net/sourceforge/jnlp/security/CertWarningPane.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -60,6 +60,7 @@
>> import net.sourceforge.jnlp.JNLPFile;
>> import net.sourceforge.jnlp.PluginBridge;
>> import net.sourceforge.jnlp.runtime.JNLPRuntime;
>> +import net.sourceforge.jnlp.security.AccessType;
>> import net.sourceforge.jnlp.tools.KeyTool;
>>
>> /**
>> @@ -85,7 +86,7 @@
>> * Creates the actual GUI components, and adds it to this panel
>> */
>> private void addComponents() {
>> - SecurityWarningDialog.AccessType type = parent.getAccessType();
>> + AccessType type = parent.getAccessType();
>> JNLPFile file = parent.getFile();
>> Certificate c = parent.getJarSigner().getPublisher();
>>
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/security/SecurityDialogMessage.java
>> --- /dev/null Thu Jan 01 00:00:00 1970 +0000
>> +++ b/netx/net/sourceforge/jnlp/security/SecurityDialogMessage.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -0,0 +1,40 @@
>> +package net.sourceforge.jnlp.security;
>> +
>> +import java.security.cert.X509Certificate;
>> +import java.util.concurrent.Semaphore;
>> +
>> +import javax.swing.JDialog;
>> +
>> +import net.sourceforge.jnlp.JNLPFile;
>> +import net.sourceforge.jnlp.security.AccessType;
>> +import net.sourceforge.jnlp.security.SecurityWarning.DialogType;
>> +
>> +/**
>> + * Represents a message to the security framework to show a specific security
>> + * dialog
>> + */
>> +final class SecurityDialogMessage {
>> +
>> + /*
>> + * These fields contain information need to display the correct dialog type
>> + */
>> +
>> + public DialogType dialogType;
>> + public AccessType accessType;
>> + public JNLPFile file;
>> + public CertVerifier certVerifier;
>> + public X509Certificate certificate;
>> + public Object[] extras;
>> +
>> + public volatile Object userResponse;
>> +
>
> Why is userResponse volatile? Based on the patch, for a given instance,
> only one thread (either the even dispatcher when action is performed OR
> another caller thread when locking throws an interruptedexception)
> modifies the value... or am I missing something?
>
I apologise in advance if my knowledge of concurrency is a little off,
but we need to ensure that setting the values on the message object
happen-before reading it. Yes, only one thread can change it, but the
change needs to propogate to the other thread. The lock ensures that
this happens in the non EventDispatchThread case. In the case of the
EventDispatchThread, one thread sets the value and the other reads it.
The volatile ensures that changes to userReponse are visible to the
client thread.
Perhaps I am wrong; I can make it non-volatile if you want me to.
>> + /*
>> + * These two fields are used to block/unblock the application or the applet.
>> + * If either of them is not null, call release() or dispose() on it to allow
>> + * the application/applet to continue.
>> + */
>> +
>> + public Semaphore lock;
>> + public JDialog toDispose;
>> +
>> +}
>> \ No newline at end of file
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/security/SecurityDialogMessageHandler.java
>> --- /dev/null Thu Jan 01 00:00:00 1970 +0000
>> +++ b/netx/net/sourceforge/jnlp/security/SecurityDialogMessageHandler.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -0,0 +1,68 @@
>> +package net.sourceforge.jnlp.security;
>> +
>> +import java.awt.event.ActionEvent;
>> +import java.awt.event.ActionListener;
>> +import java.util.concurrent.BlockingQueue;
>> +import java.util.concurrent.LinkedBlockingQueue;
>> +
>> +import net.sourceforge.jnlp.runtime.JNLPRuntime;
>> +
>> +/**
>> + * Handles {@link SecurityDialogMessage}s and shows appropriate security dialogs
>> + */
>> +public final class SecurityDialogMessageHandler implements Runnable {
>> +
>> + private BlockingQueue<SecurityDialogMessage> queue = new LinkedBlockingQueue<SecurityDialogMessage>();
>> +
>> + @Override
>> + public void run() {
>> + try {
>> + if (JNLPRuntime.isDebug()) {
>> + System.out.println("Starting security dialog thread");
>> + }
>> + while (true) {
>> + SecurityDialogMessage msg = queue.take();
>> + handleMessage(msg);
>> + }
>> + } catch (InterruptedException e) {
>> + if (JNLPRuntime.isDebug()) {
>> + System.out.println("Shutting down security event thread");
>> + }
>> + return;
>> + }
>> +
>> + }
>> +
>
> If a misbehaving trusted app does an interruptall, the above would run
> into problems.
>
Ah, good catch. I have modified to the code to simply continue if
Interrupted.
>> + private void handleMessage(SecurityDialogMessage message) {
>> + final SecurityDialogMessage msg = message;
>> +
>> + final SecurityWarningDialog dialog = new SecurityWarningDialog(message.dialogType,
>> + message.accessType, message.file, message.certVerifier, message.certificate, message.extras);
>> +
>> + dialog.addActionListener(new ActionListener() {
>> +
>> + @Override
>> + public void actionPerformed(ActionEvent e) {
>> + msg.userResponse = dialog.getValue();
>> + /* Allow the client to continue on the other side */
>> + if (msg.toDispose != null) {
>> + msg.toDispose.dispose();
>> + }
>> + if (msg.lock != null) {
>> + msg.lock.release();
>> + }
>> + }
>> + });
>> + dialog.setVisible(true);
>> +
>> + }
>> +
>> + public void postMessage(SecurityDialogMessage message) {
>> + try {
>> + queue.put(message);
>> + } catch (InterruptedException e) {
>> + e.printStackTrace();
>> + }
>> + }
>> +
>> +}
>
> There are almost no comments in the above file. Can you please add some,
> stating what those functions are doing?
>
Done.
>> diff -r afdd3f284524 netx/net/sourceforge/jnlp/security/SecurityWarning.java
>> --- /dev/null Thu Jan 01 00:00:00 1970 +0000
>> +++ b/netx/net/sourceforge/jnlp/security/SecurityWarning.java Tue Oct 19 12:07:40 2010 -0400
>> @@ -0,0 +1,278 @@
>> +/* SecurityWarningDialogFactory.java
>> + Copyright (C) 2010 Red Hat, Inc.
>> +
>> +This file is part of IcedTea.
>> +
>> +IcedTea is free software; you can redistribute it and/or
>> +modify it under the terms of the GNU General Public License as published by
>> +the Free Software Foundation, version 2.
>> +
>> +IcedTea is distributed in the hope that it will be useful,
>> +but WITHOUT ANY WARRANTY; without even the implied warranty of
>> +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
>> +General Public License for more details.
>> +
>> +You should have received a copy of the GNU General Public License
>> +along with IcedTea; see the file COPYING. If not, write to
>> +the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
>> +02110-1301 USA.
>> +
>> +Linking this library statically or dynamically with other modules is
>> +making a combined work based on this library. Thus, the terms and
>> +conditions of the GNU General Public License cover the whole
>> +combination.
>> +
>> +As a special exception, the copyright holders of this library give you
>> +permission to link this library with independent modules to produce an
>> +executable, regardless of the license terms of these independent
>> +modules, and to copy and distribute the resulting executable under
>> +terms of your choice, provided that you also meet, for each linked
>> +independent module, the terms and conditions of the license of that
>> +module. An independent module is a module which is not derived from
>> +or based on this library. If you modify this library, you may extend
>> +this exception to your version of the library, but you are not
>> +obligated to do so. If you do not wish to do so, delete this
>> +exception statement from your version.
>> +*/
>> +
>> +
>> +package net.sourceforge.jnlp.security;
>> +
>> +import java.awt.Dialog.ModalityType;
>> +import java.awt.event.WindowAdapter;
>> +import java.awt.event.WindowEvent;
>> +import java.security.AccessController;
>> +import java.security.PrivilegedAction;
>> +import java.util.concurrent.Semaphore;
>> +
>> +import javax.swing.JDialog;
>> +import javax.swing.SwingUtilities;
>> +
>> +import net.sourceforge.jnlp.JNLPFile;
>> +import net.sourceforge.jnlp.runtime.JNLPRuntime;
>> +
>> +/**
>> + * A factory for showing many possible types of security warning to the user.<p>
>> + *
>> + * This contains all the public methods that classes outside this package should
>> + * use instead of using {@link SecurityWarningDialog} directly.
>> + *
>> + * All of these methods post a message to the
>> + * {@link SecurityDialogMessageHandler} and block waiting for a response.
>> + */
>> +public class SecurityWarning {
>> + /** Types of dialogs we can create */
>> + public static enum DialogType {
>> + CERT_WARNING,
>> + MORE_INFO,
>> + CERT_INFO,
>> + SINGLE_CERT_INFO,
>> + ACCESS_WARNING,
>> + NOTALLSIGNED_WARNING,
>> + APPLET_WARNING
>> + }
>> +
>> + /**
>> + * Shows a warning dialog for different types of system access (i.e. file
>> + * open/save, clipboard read/write, printing, etc).
>> + *
>> + * @param accessType the type of system access requested.
>> + * @param file the jnlp file associated with the requesting application.
>> + * @return true if permission was granted by the user, false otherwise.
>> + */
>> + public static boolean showAccessWarningDialog(AccessType accessType, JNLPFile file) {
>> + return showAccessWarningDialog(accessType, file, null);
>> + }
>> +
>> + /**
>> + * Shows a warning dialog for different types of system access (i.e. file
>> + * open/save, clipboard read/write, printing, etc).
>> + *
>> + * @param accessType the type of system access requested.
>> + * @param file the jnlp file associated with the requesting application.
>> + * @param extras an optional array of Strings (typically) that gets
>> + * passed to the dialog labels.
>> + * @return true if permission was granted by the user, false otherwise.
>> + */
>> + public static boolean showAccessWarningDialog(final AccessType accessType,
>> + final JNLPFile file, final Object[] extras) {
>> + final SecurityDialogMessage message = new SecurityDialogMessage();
>> +
>> + message.dialogType = DialogType.ACCESS_WARNING;
>> + message.accessType = accessType;
>> + message.file = file;
>> + message.extras = extras;
>> +
>> + Object selectedValue = getUserResponse(message);
>> +
>> + if (selectedValue == null) {
>> + return false;
>> + } else if (selectedValue instanceof Integer) {
>> + if (((Integer) selectedValue).intValue() == 0)
>> + return true;
>> + else
>> + return false;
>> + } else {
>> + return false;
>> + }
>> + }
>> +
>> + /**
>> + * Shows a warning dialog for when the main application jars are signed,
>> + * but extensions aren't
>> + *
>> + * @return true if permission was granted by the user, false otherwise.
>> + */
>> + public static boolean showNotAllSignedWarningDialog(JNLPFile file) {
>> +
>> + final SecurityDialogMessage message = new SecurityDialogMessage();
>> + message.dialogType = DialogType.NOTALLSIGNED_WARNING;
>> + message.accessType = AccessType.NOTALLSIGNED;
>> + message.file = file;
>> + message.extras = new Object[0];
>> +
>> + Object selectedValue = getUserResponse(message);
>> +
>> + if (selectedValue == null) {
>> + return false;
>> + } else if (selectedValue instanceof Integer) {
>> + if (((Integer)selectedValue).intValue() == 0) {
>> + return true;
>> + } else {
>> + return false;
>> + }
>> + } else {
>> + return false;
>> + }
>> + }
>> +
>> + /**
>> + * Shows a security warning dialog according to the specified type of
>> + * access. If<code>type</code> is one of AccessType.VERIFIED or
>> + * AccessType.UNVERIFIED, extra details will be available with regards
>> + * to code signing and signing certificates.
>> + *
>> + * @param accessType the type of warning dialog to show
>> + * @param file the JNLPFile associated with this warning
>> + * @param jarSigner the JarSigner used to verify this application
>> + */
>> + public static boolean showCertWarningDialog(AccessType accessType,
>> + JNLPFile file, CertVerifier jarSigner) {
>> +
>> + final SecurityDialogMessage message = new SecurityDialogMessage();
>> + message.dialogType = DialogType.CERT_WARNING;
>> + message.accessType = accessType;
>> + message.file = file;
>> + message.certVerifier = jarSigner;
>> +
>> + Object selectedValue = getUserResponse(message);
>> +
>> + if (selectedValue == null) {
>> + return false;
>> + } else if (selectedValue instanceof Integer) {
>> + if (((Integer) selectedValue).intValue() == 0)
>> + return true;
>> + else
>> + return false;
>> + } else {
>> + return false;
>> + }
>> + }
>> +
>> + /**
>> + * FIXME This is unused. Remove it?
>> + * @return (0, 1, 2) => (Yes, No, Cancel)
>> + */
>> + public static int showAppletWarning() {
>> +
>> + SecurityDialogMessage message = new SecurityDialogMessage();
>> + message.dialogType = DialogType.APPLET_WARNING;
>> +
>> + Object selectedValue = getUserResponse(message);
>> +
>> + // result 0 = Yes, 1 = No, 2 = Cancel
>> + if (selectedValue == null) {
>> + return 2;
>> + } else if (selectedValue instanceof Integer) {
>> + return ((Integer) selectedValue).intValue();
>> + } else {
>> + return 2;
>> + }
>> + }
>> +
>> + /**
>> + * Posts the message to the SecurityThread and gets the response. Blocks
>> + * until a response has been recieved. It's safe to call this from an
>> + * EventDispatchThread.
>> + *
>> + * @param message the SecuritDialogMessage indicating what type of dialog to
>> + * display
>> + * @return The user's response. Can be null. The exact answer depends on the
>> + * type of message, but generally an Integer corresponding to the value 0
>> + * indicates success/proceed, and everything else indicates failure
>> + */
>> + private static Object getUserResponse(final SecurityDialogMessage message) {
>> + /*
>> + * Want to show a security warning, while blocking the client
>> + * application. This would be easy except there is a bug in showing
>> + * modal JDialogs in a different AppContext. The source EventQueue -
>> + * that sends the message to the (destination) EventQueue which is
>> + * supposed to actually show the dialog - must not block. If the source
>> + * EventQueue blocks, the destination EventQueue stops responding. So we
>> + * have a hack here to work around it.
>> + */
>> +
>> + /*
>> + * If this is the event dispatch thread the use the hack
>> + */
>> + if (SwingUtilities.isEventDispatchThread()) {
>> + /*
>> + * Create a tiny modal dialog (which creates a new EventQueue for
>> + * this AppContext, but blocks the original client EventQueue) and
>> + * then post the message - this makes the source EventQueue continue
>> + * running - but dot not allow the actual applet/application to
>> + * continue processing
>> + */
>> + final JDialog fakeDialog = new JDialog();
>> + fakeDialog.setSize(0, 0);
>> + fakeDialog.setResizable(false);
>> + fakeDialog.setModalityType(ModalityType.APPLICATION_MODAL);
>> + fakeDialog.addWindowListener(new WindowAdapter() {
>> +
>> + @Override
>> + public void windowOpened(WindowEvent e) {
>> + message.toDispose = fakeDialog;
>> + message.lock = null;
>> + AccessController.doPrivileged(new PrivilegedAction<Void>() {
>> + @Override
>> + public Void run() {
>> + JNLPRuntime.getSecurityDialogHandler().postMessage(message);
>> + return null;
>> + }
>> + });
>> + }
>> + });
>> +
>> + /* this dialog will be disposed/hidden when the user closes the security prompt */
>> + fakeDialog.setVisible(true);
>> + } else {
>> + /*
>> + * Otherwise do it the normal way. Post a message to the security
>> + * thread to make it show the security dialog. Wait until it tells us
>> + * to proceed.
>> + */
>> + message.toDispose = null;
>> + message.lock = new Semaphore(0);
>> + JNLPRuntime.getSecurityDialogHandler().postMessage(message);
>> +
>> + try {
>> + message.lock.acquire();
>> + } catch (InterruptedException e) {
>> + message.userResponse = null;
>> + }
>> + }
>> +
>> + return message.userResponse;
>> + }
>> +
>> +}
>
> See comment above. An interruptall would cause all subsequent warning
> dialogs by other applets in the vm to return a null user response.
>
Fixed. It now waits in the loop until it gets a response.
> Rest looks fine to me!
>
Thanks again for the review.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: icedtea-web-eventqueue-06.patch
Type: text/x-patch
Size: 55475 bytes
Desc: not available
Url : http://mail.openjdk.java.net/pipermail/distro-pkg-dev/attachments/20101020/07385959/icedtea-web-eventqueue-06.patch
More information about the distro-pkg-dev
mailing list