/hg/icedtea-web: RH738814: Access denied at ssl handshake

[omajid at icedtea.classpath.org]

changeset 16c81f4dcf12 in /hg/icedtea-web
details: http://icedtea.classpath.org/hg/icedtea-web?cmd=changeset;node=16c81f4dcf12
author: Omair Majid <omajid at redhat.com>
date: Fri Sep 23 12:05:43 2011 -0400

	RH738814: Access denied at ssl handshake

	It turns out that TrustManager.checkTrusted() could be called by
	untrusted code. In such a case, we should still show a warning to
	the user, and not throw a SecurityException instead.

	2011-09-23 Omair Majid <omajid at redhat.com>

	 * netx/net/sourceforge/jnlp/security/SecurityDialogs.java
	(showCertWarningDialog): Add a javadoc comment.
	    * netx/net/sourceforge/jnlp/security/VariableX509TrustManager.java
	(askUser): Wrap the call to showCertWarningDialog in a doPrivileged
	block.


diffstat:

 ChangeLog                                                        |   9 +++++
 NEWS                                                             |   1 +
 netx/net/sourceforge/jnlp/security/SecurityDialogs.java          |   2 +
 netx/net/sourceforge/jnlp/security/VariableX509TrustManager.java |  18 +++++++--
 4 files changed, 25 insertions(+), 5 deletions(-)

diffs (81 lines):

diff -r 1fc5f8ceb75c -r 16c81f4dcf12 ChangeLog
--- a/ChangeLog	Thu Sep 22 17:00:02 2011 -0400
+++ b/ChangeLog	Fri Sep 23 12:05:43 2011 -0400
@@ -1,3 +1,12 @@
+2011-09-23  Omair Majid  <omajid at redhat.com>
+
+	RH738814: Access denied at ssl handshake
+	* netx/net/sourceforge/jnlp/security/SecurityDialogs.java
+	(showCertWarningDialog): Add a javadoc comment.
+	* netx/net/sourceforge/jnlp/security/VariableX509TrustManager.java
+	(askUser): Wrap the call to showCertWarningDialog in a doPrivileged
+	block.
+
 2011-09-22  Omair Majid  <omajid at redhat.com>
 
 	PR788: Elluminate Live! is not working
diff -r 1fc5f8ceb75c -r 16c81f4dcf12 NEWS
--- a/NEWS	Thu Sep 22 17:00:02 2011 -0400
+++ b/NEWS	Fri Sep 23 12:05:43 2011 -0400
@@ -26,6 +26,7 @@
   - PR769: IcedTea-Web does not work with some ssl sites with OpenJDK7
   - PR789: typo in jrunscript.sh
   - RH734081: Javaws cannot use proxy settings from Firefox
+  - RH738814: Access denied at ssl handshake
 
 New in release 1.1 (2011-XX-XX):
 * Security updates
diff -r 1fc5f8ceb75c -r 16c81f4dcf12 netx/net/sourceforge/jnlp/security/SecurityDialogs.java
--- a/netx/net/sourceforge/jnlp/security/SecurityDialogs.java	Thu Sep 22 17:00:02 2011 -0400
+++ b/netx/net/sourceforge/jnlp/security/SecurityDialogs.java	Fri Sep 23 12:05:43 2011 -0400
@@ -181,6 +181,8 @@
      * @param accessType the type of warning dialog to show
      * @param file the JNLPFile associated with this warning
      * @param jarSigner the JarSigner used to verify this application
+     *
+     * @return true if the user accepted the certificate
      */
     public static boolean showCertWarningDialog(AccessType accessType,
             JNLPFile file, CertVerifier jarSigner) {
diff -r 1fc5f8ceb75c -r 16c81f4dcf12 netx/net/sourceforge/jnlp/security/VariableX509TrustManager.java
--- a/netx/net/sourceforge/jnlp/security/VariableX509TrustManager.java	Thu Sep 22 17:00:02 2011 -0400
+++ b/netx/net/sourceforge/jnlp/security/VariableX509TrustManager.java	Fri Sep 23 12:05:43 2011 -0400
@@ -37,7 +37,9 @@
 
 package net.sourceforge.jnlp.security;
 
+import java.security.AccessController;
 import java.security.KeyStore;
+import java.security.PrivilegedAction;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
@@ -380,17 +382,23 @@
      * @param authType The authentication algorithm
      * @return user's response
      */
-    private boolean askUser(X509Certificate[] chain, String authType,
-                            boolean isTrusted, boolean hostMatched,
-                            String hostName) {
+    private boolean askUser(final X509Certificate[] chain, final String authType,
+                            final boolean isTrusted, final boolean hostMatched,
+                            final String hostName) {
         if (JNLPRuntime.isTrustAll()){
             return true;
         }
-        return SecurityDialogs.showCertWarningDialog(
+        final VariableX509TrustManager trustManager = this;
+        return AccessController.doPrivileged(new PrivilegedAction<Boolean>() {
+            @Override
+            public Boolean run() {
+                return SecurityDialogs.showCertWarningDialog(
                         AccessType.UNVERIFIED, null,
-                        new HttpsCertVerifier(this, chain, authType,
+                        new HttpsCertVerifier(trustManager, chain, authType,
                                               isTrusted, hostMatched,
                                               hostName));
+            }
+        });
     }
 
     /**