[rfc][icedtea-web] Mixed-signing applet permissions (PR1592)

[Jiri Vanek]

On 12/02/2013 04:40 PM, Andrew Azores wrote:
> On 11/28/2013 12:03 PM, Jiri Vanek wrote:
>> (snip)
>>
>> ok, it sounds excelent.
>> For changes you mention, I'm looking forward to new patch
>> for reproducer, please remake you dirty one reproducer as regullar reproducer
>> - have one jar created via simple, and one via siged.
>> - in one of them have jnlp and html files under sources
>> - you can adapt the calls between jars via args/params
>> - in one of them have testcase, which will lunch all the mentioned cases (but commetn out @Test untill issue with dialogue is fixed)
>> - rember that test must have at least on @test method
>> - have comment both in both srcs, and in testcase, that those two jars are connected
>> - adapt above to your feelings, this is just group of advices of ill men :)
>>
>> Sorry for insisting :(
>> J
>
> Attached is the new version of the patch. From last time:
> 1) "signing" became a three-valued enum
> 2a) a new method was added in the classloader to make showing the "not all signed" dialog a little cleaner
> 2b) the "not all signed" dialog will not appear when the security setting is "Low"
> 3) verifying single JAR was moved into JarCertVerifier
>
> Tests are also included. Before the patch is applied, the "testSignedReadProperties" test should fail, and all the others should pass. Applying the patch should result in all tests passing.
>
> ChangeLog:
> Fix/new feature and tests for PR1592. Each JAR in partially signed applets is assigned
> its own security level, rather than forcing the entire applet to run sandboxed.
> * netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java: (initializeResources)
> each JAR in partially signed applets is assigned its own security descriptor.
> (signing) changed to three-valued enum. (checkNotAllSignedWithUser) new method
> * netx/net/sourceforge/jnlp/tools/JarCertVerifier.java: (isJarSigned) new method
> * tests/reproducers/signed/MixedSigningAppletSigned/srcs/MixedSigningAppletSigned.java:
> new tests for per-JAR applet security
> * tests/reproducers/signed/MixedSigningAppletSigned/testcases/MixedSigningAppletSignedTests.java: same
> * tests/reproducers/simple/MixedSigningApplet/resources/MixedSigningApplet-1.jnlp: same
> * tests/reproducers/simple/MixedSigningApplet/resources/MixedSigningApplet-2.jnlp: same
> * tests/reproducers/simple/MixedSigningApplet/resources/MixedSigningApplet-3.jnlp: same
> * tests/reproducers/simple/MixedSigningApplet/resources/MixedSigningApplet-4.jnlp: same
> * tests/reproducers/simple/MixedSigningApplet/resources/MixedSigningApplet-5.jnlp: same
> * tests/reproducers/simple/MixedSigningApplet/resources/MixedSigningApplet-6.jnlp: same
> * tests/reproducers/simple/MixedSigningApplet/resources/MixedSigningApplet.html: same
> * tests/reproducers/simple/MixedSigningApplet/srcs/MixedSigningAppletHelper.java: same
>


ok. The patch itself can go in now.

The tests too(as separate chnageset) , but please, *comment* *out* all @Test which require user's action.

J.

ps - only applets need user action, right? All jnlp-by lunched hoour -Xtrust all correct?
pps -  thw rok not done.. see  the reply "Re: [icedtea-web] "Not All Signed" dialog and low-security setting"