签名的applet在从javascript调用时给出AccessControlException:访问被拒绝

Question

我有一个简单的自签名小程序(用keytool和jarsigner完成):

public class NetAppletLauncher extends JApplet {

    private static final long serialVersionUID = 1L;

    public void init() {
        exec("notepad c:/hello.txt");
    }

    public void exec(String command) {

        try {

            // launch EXE and grab stdin/stdout and stderr
            Process process = Runtime.getRuntime().exec(command);
            //      OutputStream stdin = process.getOutputStream();
            InputStream stderr = process.getErrorStream();
            InputStream stdout = process.getInputStream();

            // "write" the parms into stdin
//          stdin.write(arguments.getBytes());
//          stdin.flush();
//          stdin.close();

            // clean up if any output in stdout
            String line = "";
            BufferedReader brCleanUp = new BufferedReader(new InputStreamReader(stdout));
            while ((line = brCleanUp.readLine()) != null) {
                //System.out.println ("[Stdout] " + line);
            }
            brCleanUp.close();

            // clean up if any output in stderr
            brCleanUp = new BufferedReader(new InputStreamReader(stderr));
            while ((line = brCleanUp.readLine()) != null) {
                //System.out.println ("[Stderr] " + line);
            }
            brCleanUp.close();

        } catch (Exception exception) {
            exception.printStackTrace();
        }

    }

}

基本上,它的作用是执行'notepad c:/hello.txt'.

然后我将applet嵌入html中:

<applet id='applet' name='applet' archive='NetAppletLauncher1.jar' code='src.NetAppletLauncher' width='100' height='100' MAYSCRIPT ></applet>

当我访问该页面时,JRE启动并询问我是否要启动此applet并且如果我信任它.我按好了.然后记事本开始 - 应该如此.这里没问题.

但后来我将其添加到HTML页面中:

<p class="link" onclick="document.applet.exec('calc');">remote desktop2</p>

现在,当我按下这个文本时,计算应该开始 - 对吧？但这给了我:

java.security.AccessControlException: access denied (java.io.FilePermission <<ALL FILES>> execute)
    at java.security.AccessControlContext.checkPermission(Unknown Source)

• 怎么了？为什么它现在给我一个安全例外,但它可以在之前启动记事本？

Answer 1

Java 2安全模型(大致)要求必须为访问控制上下文(acc)授予堆栈中的每个帧以获得该权限.JavaScript位于堆栈中,没有文件访问权限.

Answer 2

用Java解决了这个问题:

exec(getParameter("command"));

然后在JavaScript中:

<script type="text/javascript">

function exec( command ) {

    var applet = "<applet id='applet' style='visibility: hidden' name='applet' archive='NetAppletLauncher4.jar' code='src.NetsetAppletLauncher' width='20' height='20' MAYSCRIPT ><param name='command' value='" + command + "' />Sorry, you need a Java-enabled browser.</applet>";

    var body = document.getElementsByTagName("body")[0];
    var div = document.createElement("div");
    div.innerHTML = applet;
    body.appendChild(div);

}

</script>