CODEWITHSUNDEEP
javaappletjapplet
Korki Korkig
Korki Korkig

Reputation: 2814

Java Applet with jar embed in HTML security issue

I embed an applet to a HTML page. The applet also uses the MySQL jar file.

It works just fine without the MySQL jar file. When executing it from the local webserver or hosted webserver it gives the following error:

Exception in thread "AWT-EventQueue-2" java.lang.ExceptionInInitializerError
at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:286)
at java.sql.DriverManager.getConnection(Unknown Source)
.........
Caused by: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "file.encoding" "read")
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)

My File list:

/appletTest.html
/mysql-connector-java-5.1.18-bin.jar
/applet/testApplet.class

testApplet.class:

package applet;

import java.applet.Applet;
import java.awt.Graphics;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class HelloWorldApplet extends Applet {

@Override
public void paint(Graphics g) {
    g.drawString("Hello World", 25, 50);

    Connection con = null;
    Statement st = null;
    ResultSet rs = null;

    String url = "jdbc:mysql://localhost:3306/testdb";

    try {
        con = DriverManager.getConnection(url, "root", ""); // <= here fails
        st = con.createStatement();
        rs = st.executeQuery("SELECT VERSION()");

        if (rs.next()) {
            g.drawString(rs.getString(1), 25, 50);
        }

    } catch (SQLException ex) {
        System.out.println(ex);
    } 
  }
}

appletTest.html: 

<html>
  <head>
  <title>Applet Test</title>
  </head>
   <body>
      <applet code="applet.testApplet.class" width="500" height="300" archive="mysql-connector-java-5.1.18-bin.jar">
      </applet>
   </body>
</html>

I assume that this security error comes because an applet cannot access to local resources unless you 'sign it' or 'change the local security policy'. But all my files are located on the webserver and the applet requests the jar file which is also located on the webserver.

So, I don't see here a local file request but still get this error. Could you please give me any suggestions?

Upvotes: 0

Views: 740

Answers (1)

Jean-Philippe Leclerc
Jean-Philippe Leclerc

Reputation: 6805

"Ordinarily, unsigned Java applets or applications may only connect back to the web server from which they originated. This restriction prevents an applet from causing denial-of-service attacks by making rapid connections to arbitrary machines on the Internet."

When you are testing, ensure that you are on the same domain as the webserver. file:///.../appletTest.html won't work even if you are accessing localhost.

That line: String url = "jdbc:mysql://localhost:3306/testdb"; will need to change to the address of your webserver.

[EDIT] And isn't is silly to open a new connection every time paint() is called?

[EDIT] I read your post more carefully. The problem is that you can't access the jar file. The easiest way is to package your driver in the same jar as your applet.

Upvotes: 1

Related Questions