<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"><base href="x-msg://11927/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi Mickey,<div><br></div><div>The issue you are seeing is intended behavior. This was caused because of a vulnerability that was fixed in 7u25 in which which a <span style="font-size: 12pt; font-family: 'Times New Roman', serif; ">getCodeBase </span>call against all local <span style="background-color: rgb(255, 255, 255); ">applet/jnlp apps will return null.</span></div><div><span style="background-color: rgb(255, 255, 255); "><br></span></div><div><span style="background-color: rgb(255, 255, 255); ">Thanks,</span></div><div><span style="background-color: rgb(255, 255, 255); ">Sandeep</span></div><div><br><div><div>On Jun 19, 2013, at 3:18 PM, "Mickey Segal" <<a href="mailto:java3@segal.org">java3@segal.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; ">The local getCodeBase problem is not present in Java 8 build 94, the most recent version. <o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; "> </span></div><div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in; "><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span>Mickey Segal [mailto:java3@<a href="http://segal.org" style="color: purple; text-decoration: underline; ">segal.org</a>]<span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, June 19, 2013 3:56 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Java Security (<a href="mailto:security-dev@openjdk.java.net" style="color: purple; text-decoration: underline; ">security-dev@openjdk.java.net</a>)<br><b>Subject:</b><span class="Apple-converted-space"> </span>RE: getCodeBase broken locally in 7 update 25<o:p></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; ">The same getCodeBase problem seems to be occurring on the MacOS version too.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; "> </span></div><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span>Mickey Segal [<a href="mailto:java3@segal.org" style="color: purple; text-decoration: underline; ">mailto:java3@segal.org</a>]</span><o:p></o:p></p><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; ">I upgraded a Windows 7 computer to Java version 1.7.0_25 from 1.7.0_21. A getCodeBase call in a signed applet now returns null. In previous versions of Java, getCodeBase returned a URL that referred to the current directory (tested from Java 1.1 to 1.7.0_21 over the years).<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; "> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; ">Was this done purposely for security reasons, or is it just a bug? <o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; "> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; ">I will also test on Macintosh and report back on macosx-port-dev if it is a problem there too.</span></div></div></div></blockquote></div><br></div></body></html>