Webstart security problem

[Wang Weijun]

> On Nov 4, 2016, at 6:24 PM, Mueller-Schramm, Gerd <gerd.mueller-schramm at hexagongeospatial.com> wrote:
> 
> I've tried jdk-9+139 with the same result, i.e. the security exception occurs.

Then maybe it's related to several modules now launching by the platform class loader. Not sure about it.

Is it easy to reproduce the failure? I'm not an expert on Java EE.

--Max

> 
> 
> Gerd Müller-Schramm 
> Software Developer, GeoMedia Smart Client Kommunal
> T: +49 341 92 60 30 47 
> E: gerd.mueller at hexagongeospatial.com
> 
> Hexagon Geospatial
> Wittenberger Straße 15B
> 04129 Leipzig, Germany
> hexagongeospatial.com
> 
> 
> 
> -----Ursprüngliche Nachricht-----
> Von: Wang Weijun [mailto:weijun.wang at oracle.com] 
> Gesendet: Freitag, 4. November 2016 04:29
> An: Mueller-Schramm, Gerd <gerd.mueller-schramm at hexagongeospatial.com>
> Cc: jdk9-dev <jdk9-dev at openjdk.java.net>
> Betreff: Re: Webstart security problem
> 
> There is a change in FilePermission in jdk-9+140 (JDK-8164705). If your application does not fail for jdk-9+139 or earlier then it might be the reason. But I still don't know why AllPermission cannot imply it.
> 
> Thanks
> Max
> 
>> On Nov 4, 2016, at 12:09 AM, Mueller-Schramm, Gerd <gerd.mueller-schramm at hexagongeospatial.com> wrote:
>> 
>> Hi,
>> 
>> When try to access a web service via java.xml.ws module from a Webstart application I get the following exception:
>> 
>> java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Program Files (x86)\Mozilla Firefox\basename" "read")
>>            at java.security.AccessControlContext.checkPermission(java.base at 9-ea/AccessControlContext.java:471)
>>            at java.security.AccessController.checkPermission(java.base at 9-ea/AccessController.java:894)
>>            at java.lang.SecurityManager.checkPermission(java.base at 9-ea/SecurityManager.java:548)
>>            at com.sun.javaws.security.JavaWebStartSecurity.checkPermission(jdk.javaws at 9-ea/JavaWebStartSecurity.java:237)
>>            at java.lang.SecurityManager.checkRead(java.base at 9-ea/SecurityManager.java:887)
>>            at java.io.File.isDirectory(java.base at 9-ea/File.java:845)
>>            at java.io.File.toURI(java.base at 9-ea/File.java:733)
>>           ...
>> 
>> and later after asking me for permission to connect to the webservice URL:
>> 
>> java.security.AccessControlException: access denied ("java.net.NetPermission" "getProxySelector")
>>            at java.security.AccessControlContext.checkPermission(java.base at 9-ea/AccessControlContext.java:471)
>>            at java.security.AccessController.checkPermission(java.base at 9-ea/AccessController.java:894)
>>           ...
>> 
>> although I've added
>> <security>
>>   <all-permissions />
>> </security>
>> 
>> to the JNLP-file and signed the Jars.
>> 
>> The same Webstart application works with Java 8.
>> 
>> Is there anything else that I need to configure?
>> 
>> I'm using JRE-version 9-ea+142 Java HotSpot(TM) 64-Bit Server VM on Windows 7.
>> 
>> Best regards,
>> Gerd
>> 
>> Gerd Müller-Schramm
>> Software Developer, GeoMedia Smart Client Kommunal
>> T: +49 341 92 60 30 47
>> E: gerd.mueller at hexagongeospatial.com<mailto:gerd.mueller at hexagongeospatial.com>
>> 
>> Hexagon Geospatial
>> Wittenberger Straße 15B
>> 04129 Leipzig, Germany
>> hexagongeospatial.com<http://hexagongeospatial.com/>
>> 
>> 
>