Applet with JDBC - java.security.AccessControlException: access denied

Question

//JDBC using Applet
/*
<applet code = JDBC1 height = 170 width = 350 >
</applet>
*/

import javax.swing.*; //JApplet,JLabel,JButton

import java.applet.*; //Applet
import java.awt.*; //Layout

import java.awt.event.*; //Events

import java.sql.*; //JDBC

public class JDBC1 extends Applet implements Runnable,ActionListener
{
JFrame frame ;
JPanel panel1;
JLabel lblNo,lblName,lblBdate ;
JTextField txtNo,txtName,txtBdate;
JButton btn;

Statement st1;
Connection cn;
ResultSet rs;

    public JDBC1()
    {
        try
        {
            panel1 = new JPanel ();
            panel1.setLayout(new GridLayout(0,2));

            lblNo = new JLabel ("Roll No : ");
            panel1.add(lblNo);

            txtNo = new JTextField(15);
            panel1.add(txtNo);

            lblName = new JLabel ("Name : ");
            panel1.add(lblName);

            txtName = new JTextField(15);
            panel1.add(txtName);

            lblBdate = new JLabel ("Birth Date : ");
            panel1.add(lblBdate);

            txtBdate = new JTextField(15);
            panel1.add(txtBdate); //Add textarea to the panel.

            add(panel1); //Add panel to the aaplet.

            btn = new JButton ("First");
            add(btn); //Add button to the applet.
            btn.addActionListener(this);

            btn = new JButton ("Next");
            add(btn);
            btn.addActionListener(this);

            btn = new JButton ("Last");
            add(btn);
            btn.addActionListener(this);

            btn = new JButton ("Prev");
            add(btn);
            btn.addActionListener(this);

            btn = new JButton ("Save");
            add(btn);
            btn.addActionListener(this);

            btn = new JButton ("Reset");
            add(btn);
            btn.addActionListener(this);

            btn = new JButton ("Delete");
            add(btn);
            btn.addActionListener(this);

            btn = new JButton ("Update");
            add(btn);
            btn.addActionListener(this);

            Class.forName("sun.jdbc.odbc.JdbcOdbcDriver"); //Load the JDBC-ODBC bridge driver
            cn = DriverManager.getConnection("jdbc:odbc:STUDENT_MYDSN"); // conection to databse

            st1 = cn.createStatement(ResultSet.TYPE_SCROLL_SENSITIVE,ResultSet.CONCUR_UPDATABLE);

            String query = "select * from Student";
            rs = st1.executeQuery(query);

        }

        catch (Exception e)
        {
            e.printStackTrace();
        }
    }

    public void init()
    {
        try
        {
            Thread th = new Thread (this);
            th.start(); 
        }
        catch(Exception ex)
        {
            System.out.println(ex.toString());
        }
    }


    public void run ()
    {
        try
        {

            while(true)
            {
                JDBC1 my = new JDBC1();
                repaint();
                Thread.sleep(1000);
            }
        }
        catch(Exception ex)
        {
            System.out.println(ex.toString());
        }
    }

    public void paint (Graphics g)
    {
        super.paint(g);
        java.util.Date dt = new java.util.Date();
        String myDate = dt+"";
        g.drawString(myDate,100,150);
    }

    void getRecord()
    {
        try
        {
            txtNo.setText((String) rs.getObject(1));
        }

        catch (Exception e)
        {
            System.out.println(e.toString());
        }
    }

    public void actionPerformed(ActionEvent e)
    {
        try
        {
            String name = ((JButton) e.getSource()).getText();

            if (name == "First")
            {

                System.out.println("First");
            }

            if (name == "Prev")
            {
                System.out.println("Prev");
            }

            if (name == "Next")
            {
                System.out.println("Next");
            }

            if (name == "Last")
            {
                System.out.println("First");
            }

            if (name == "Save")
            {
                System.out.println("First");
            }

            if (name == "Delete")
            {
                System.out.println("First");
            }

            if (name == "Update")
            {
                System.out.println("First");
            }

            if (name == "Reset")
            {
                System.out.println("First");
            }
        }

        catch (Exception ex)
        {
            System.out.println(ex.toString());
            ex.printStackTrace();
        }
    }

}

By using this Applet with JDBC , I will getting below error

java.security.AccessControlException: access denied ("java.util.PropertyPermission" "file.encoding"
            at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)
            at java.security.AccessController.checkPermission(AccessController.java:560)
            at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
            at java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1302)
            at java.lang.System.getProperty(System.java:706)
            at sun.jdbc.odbc.JdbcOdbcConnection.initialize(JdbcOdbcConnection.java:142)
            at sun.jdbc.odbc.JdbcOdbcDriver.connect(JdbcOdbcDriver.java:174)
            at java.sql.DriverManager.getConnection(DriverManager.java:579)
            at java.sql.DriverManager.getConnection(DriverManager.java:243)
            at JDBC1.<init>(JDBC1.java:87)
            at JDBC1.run(JDBC1.java:123)
            at java.lang.Thread.run(Thread.java:722)

Answer 1

You wont be able to access ODBC drivers from an (untrusted) applet, same as you wont be able to read the local file system.

There are "pure Java" JDBC drivers which only need socket permissions. This will work if the database server is available through the same origin ("Same Origin Policy") as the web server that delivered the applet (and there's nothing interfering on the network).

However, it's probably a bad idea to expose a database over the network to end users. Usually you would expose a safe interface through a web server. Also if the applet is loaded over a network, it's unlikely that you'd want to pick up a locally configured database.

(The code in the question seems extraordinary long compared to a minimum complete program that expresses the problem, but I could go on for ever criticising code.)

Answer 2

You won't be able to run JDBC in an applet without taking steps to give the applet appropriate permissions. The topic is covered in detail by this tutorial from Oracle.