Applet java.io.FilePermission exception

Question

I have a Java applet for an intranet site which needs to access the file system on the client's PC (specifically a LAN share). This applet has a function similar to:

JSObject win;

public void init() {
    win=(JSObject) JSObject.getWindow(this);
    win.call("appletMsg", new Object[] {"<b>Applet Loaded</b>", "win"});
}

public void saveFile(String filepath, String filename) {
    File theDir = new File(filepath);
    try {
        if (theDir.exists()) { // This throws exception
            win.call("appletMsg", new Object[] {"Directory Exists", "win"});
        }
        else {
            win.call("appletMsg", new Object[] {"Creating Directory...", "msg"});
            if (theDir.mkdir()) {
                win.call("appletMsg", new Object[] {"Directory Created", "win"});
            }
            else win.call("appletMsg", new Object[] {"Directory Creation Failed!", "fail"});
        }
    }
    catch (Exception e) { // This exception is caught
        win.call("appletMsg", new Object[] {"Error Reading Directory!", "fail"});
        win.call("appletMsg", new Object[] {filepath, "fail"});
    }
    // More code for working with files, error happens above this
}

Javascript behind the applet

// call applet method
function save() {
    document.myApplet.saveFile('\\\\LOCATION\\DIR\\DIR\\', 'test.txt');
}

// output responses from applet to div
function appletMsg(response, type) {
    document.getElementById('output').innerHTML+='<br><span class='+type+'>'+response+'</span>';
}

Troubleshooting/Thoughts:

• the applet worked before I made the JS call the Java method (arguments were in param lists, applet was fully reloaded when needed, file operations were in init() method, reverting to this works but is terrible practice)
• the applet is signed with a self-cert
• I put a JFileChooser in the init() method to make sure paths were right, moved it to the saveFile() method and the dialog does not show. It doesn't cause a JS error to show like it did with the .exists() call in Java, it does throw a FilePermission exception in a try/catch
• since this works in init() and not in saveFile() I can only assume this is to prevent JavaScript itself from accessing the file system??

Answer 1

To be able to call your applet functions from JavaScript, you have to use an access controller. See documentation.

So try :

public void saveFile(String filepath, String filename) {
    AccessController.doPrivileged(new PrivilegedAction() {
        public Object run() {
            File theDir = new File(filepath);
            try {
                if (theDir.exists()) { // This throws exception
                    win.call("appletMsg", new Object[] { "Directory Exists", "win" });
                } else {
                    win.call("appletMsg", new Object[] { "Creating Directory...", "msg" });
                    if (theDir.mkdir()) {
                        win.call("appletMsg", new Object[] { "Directory Created", "win" });
                    } else
                        win.call("appletMsg", new Object[] { "Directory Creation Failed!", "fail" });
                }
            } catch (Exception e) { // This exception is caught
                win.call("appletMsg", new Object[] { "Error Reading Directory!", "fail" });
                win.call("appletMsg", new Object[] { filepath, "fail" });
            }
            // More code for working with files, error happens above this
        }
    });
}

It works even using a self-signed certificate, you will simply get the security warning.

Always remember to make the privileged code section as small as possible.