Webstart security problem

[Wang Weijun]

> On Nov 4, 2016, at 7:55 PM, Mueller-Schramm, Gerd <gerd.mueller-schramm at hexagongeospatial.com> wrote:
> 
> You only need to build a Webservice client like this:
> 
> URL serviceUrl = new URL("http://127.0.0.1/MyService/myservice.svc?wsdl");
> MyService_Service serviceCreator = new MyService_Service(serviceUrl, new QName(
> 	"http://services.mycompany.com/Myservice", "MyService"));
> 
> MyService_Service was generated from a WSDL and of course you'll need a server for this.
> It always happens.

Sorry I should have been more modest. When I said I was not a Java EE expert, I actually meant I knew nothing about Java EE. There is only JDK on my computer.

> 
> Has each module it's own classloader?

There are 2 class loaders loading JDK classes now, the boot loader loading modules like java.base etc, the platform loader loading some other modules (see http://hg.openjdk.java.net/jdk9/dev/file/e41be20156e6/make/common/Modules.gmk#l47).

The platform modules do not always have AllPermission.

--Max

> 
> Gerd Müller-Schramm 
> Software Developer, GeoMedia Smart Client Kommunal
> T: +49 341 92 60 30 47 
> E: gerd.mueller at hexagongeospatial.com
> 
> Hexagon Geospatial
> Wittenberger Straße 15B
> 04129 Leipzig, Germany
> hexagongeospatial.com
> 
> 
> 
> -----Ursprüngliche Nachricht-----
> Von: Wang Weijun [mailto:weijun.wang at oracle.com] 
> Gesendet: Freitag, 4. November 2016 12:27
> An: Mueller-Schramm, Gerd <gerd.mueller-schramm at hexagongeospatial.com>
> Cc: jdk9-dev <jdk9-dev at openjdk.java.net>
> Betreff: Re: Webstart security problem
> 
> 
>> On Nov 4, 2016, at 6:24 PM, Mueller-Schramm, Gerd <gerd.mueller-schramm at hexagongeospatial.com> wrote:
>> 
>> I've tried jdk-9+139 with the same result, i.e. the security exception occurs.
> 
> Then maybe it's related to several modules now launching by the platform class loader. Not sure about it.
> 
> Is it easy to reproduce the failure? I'm not an expert on Java EE.
> 
> --Max
> 
>> 
>> 
>> Gerd Müller-Schramm 
>> Software Developer, GeoMedia Smart Client Kommunal
>> T: +49 341 92 60 30 47 
>> E: gerd.mueller at hexagongeospatial.com
>> 
>> Hexagon Geospatial
>> Wittenberger Straße 15B
>> 04129 Leipzig, Germany
>> hexagongeospatial.com
>> 
>> 
>> 
>> -----Ursprüngliche Nachricht-----
>> Von: Wang Weijun [mailto:weijun.wang at oracle.com] 
>> Gesendet: Freitag, 4. November 2016 04:29
>> An: Mueller-Schramm, Gerd <gerd.mueller-schramm at hexagongeospatial.com>
>> Cc: jdk9-dev <jdk9-dev at openjdk.java.net>
>> Betreff: Re: Webstart security problem
>> 
>> There is a change in FilePermission in jdk-9+140 (JDK-8164705). If your application does not fail for jdk-9+139 or earlier then it might be the reason. But I still don't know why AllPermission cannot imply it.
>> 
>> Thanks
>> Max
>> 
>>> On Nov 4, 2016, at 12:09 AM, Mueller-Schramm, Gerd <gerd.mueller-schramm at hexagongeospatial.com> wrote:
>>> 
>>> Hi,
>>> 
>>> When try to access a web service via java.xml.ws module from a Webstart application I get the following exception:
>>> 
>>> java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Program Files (x86)\Mozilla Firefox\basename" "read")
>>>         at java.security.AccessControlContext.checkPermission(java.base at 9-ea/AccessControlContext.java:471)
>>>         at java.security.AccessController.checkPermission(java.base at 9-ea/AccessController.java:894)
>>>         at java.lang.SecurityManager.checkPermission(java.base at 9-ea/SecurityManager.java:548)
>>>         at com.sun.javaws.security.JavaWebStartSecurity.checkPermission(jdk.javaws at 9-ea/JavaWebStartSecurity.java:237)
>>>         at java.lang.SecurityManager.checkRead(java.base at 9-ea/SecurityManager.java:887)
>>>         at java.io.File.isDirectory(java.base at 9-ea/File.java:845)
>>>         at java.io.File.toURI(java.base at 9-ea/File.java:733)
>>>        ...
>>> 
>>> and later after asking me for permission to connect to the webservice URL:
>>> 
>>> java.security.AccessControlException: access denied ("java.net.NetPermission" "getProxySelector")
>>>         at java.security.AccessControlContext.checkPermission(java.base at 9-ea/AccessControlContext.java:471)
>>>         at java.security.AccessController.checkPermission(java.base at 9-ea/AccessController.java:894)
>>>        ...
>>> 
>>> although I've added
>>> <security>
>>> <all-permissions />
>>> </security>
>>> 
>>> to the JNLP-file and signed the Jars.
>>> 
>>> The same Webstart application works with Java 8.
>>> 
>>> Is there anything else that I need to configure?
>>> 
>>> I'm using JRE-version 9-ea+142 Java HotSpot(TM) 64-Bit Server VM on Windows 7.
>>> 
>>> Best regards,
>>> Gerd
>>> 
>>> Gerd Müller-Schramm
>>> Software Developer, GeoMedia Smart Client Kommunal
>>> T: +49 341 92 60 30 47
>>> E: gerd.mueller at hexagongeospatial.com<mailto:gerd.mueller at hexagongeospatial.com>
>>> 
>>> Hexagon Geospatial
>>> Wittenberger Straße 15B
>>> 04129 Leipzig, Germany
>>> hexagongeospatial.com<http://hexagongeospatial.com/>
>>> 
>>> 
>> 
>