Getting SecurityException when deserializing object despite using AllPermission java policy

Question

In my XPages application, I backup certain objects by serializing and saving them to MIME entities in backup documents. To reload the objects later, I use the following server-side JavaScript function for deserialization:

var entity:NotesMIMEEntity=doc.getMIMEEntity(field);
if (!entity) return null;
var stream:NotesStream=session.createStream();
entity.getContentAsBytes(stream);
stream.setPosition(0);
var ois:java.io.ObjectInputStream=new java.io.ObjectInputStream(new java.io.ByteArrayInputStream(stream.read()));
var o=ois.readObject(); // ERROR OCCURS IN THIS LINE
ois.close();
entity.recycle();
doc.closeMIMEEntities(false,field);

When I try to read the object from the stream, an exception is raised:

java.lang.SecurityException: Java bridge is not allowed

I have set the java.security.AllPermission in the java.policy file, so I don't know why this exception is raised anyway. I also found that this problem only occurs when I run my application in the Notes Client, but everything works fine when I run it in the browser via the Domino server.

Can anybody tell me how to solve this issue?

PS: Here is the full trace for the SecurityException:

java.lang.SecurityException: Java bridge is not allowed
at com.ibm.jscript.types.JavaAccessObject.<init>(Unknown Source)
at com.ibm.jscript.types.FBSUtility.wrapAsObject(Unknown Source)
at com.ibm.jscript.types.FBSUtility.wrap(Unknown Source)
at com.ibm.jscript.types.FBSValue.readValue(Unknown Source)
at com.ibm.jscript.types.FBSDefaultObject.readExternal(Unknown Source)
at com.ibm.jscript.std.ObjectObject.readExternal(Unknown Source)
at java.io.ObjectInputStream.readExternalData(Unknown Source)
at java.io.ObjectInputStream.readOrdinaryObject(Unknown Source)
at java.io.ObjectInputStream.readObject0(Unknown Source)
at java.io.ObjectInputStream.readObject(Unknown Source)
at sun.reflect.GeneratedMethodAccessor35.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.ibm.jscript.types.JavaAccessObject.call(Unknown Source)
at com.ibm.jscript.types.FBSObject.call(Unknown Source)
at com.ibm.jscript.ASTTree.ASTCall.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTVariableDecl.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTBlock.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTTry.interpret(Unknown Source)
at com.ibm.jscript.std.FunctionObject._executeFunction(Unknown Source)
at com.ibm.jscript.std.FunctionObject.executeFunction(Unknown Source)
at com.ibm.jscript.std.FunctionObject.call(Unknown Source)
at com.ibm.jscript.types.FBSObject.call(Unknown Source)
at com.ibm.jscript.ASTTree.ASTCall.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTAssign.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTBlock.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTIf.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTBlock.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTTry.interpret(Unknown Source)
at com.ibm.jscript.std.FunctionObject._executeFunction(Unknown Source)
at com.ibm.jscript.std.FunctionObject.executeFunction(Unknown Source)
at com.ibm.jscript.std.FunctionObject.call(Unknown Source)
at com.ibm.jscript.types.FBSObject.call(Unknown Source)
at com.ibm.jscript.ASTTree.ASTCall.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTAssign.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTBlock.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTForIn.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTBlock.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTTry.interpret(Unknown Source)
at com.ibm.jscript.std.FunctionObject._executeFunction(Unknown Source)
at com.ibm.jscript.std.FunctionObject.executeFunction(Unknown Source)
at com.ibm.jscript.std.FunctionObject.call(Unknown Source)
at com.ibm.jscript.types.FBSObject.call(Unknown Source)
at com.ibm.jscript.ASTTree.ASTCall.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTBlock.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTTry.interpret(Unknown Source)
at com.ibm.jscript.std.FunctionObject._executeFunction(Unknown Source)
at com.ibm.jscript.std.FunctionObject.executeFunction(Unknown Source)
at com.ibm.jscript.std.FunctionObject.call(Unknown Source)
at com.ibm.jscript.types.FBSObject.call(Unknown Source)
at com.ibm.jscript.ASTTree.ASTCall.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTUnaryOp.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTIf.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTProgram.interpret(Unknown Source)
at com.ibm.jscript.ASTTree.ASTProgram.interpretEx(Unknown Source)
at com.ibm.jscript.JSExpression._interpretExpression(Unknown Source)
at com.ibm.jscript.JSExpression.access$1(Unknown Source)
at com.ibm.jscript.JSExpression$2.run(Unknown Source)
at java.security.AccessController.doPrivileged(Unknown Source)
at com.ibm.jscript.JSExpression.interpretExpression(Unknown Source)
at com.ibm.jscript.JSExpression.evaluateValue(Unknown Source)
at com.ibm.jscript.JSExpression.evaluateValue(Unknown Source)
at com.ibm.xsp.javascript.JavaScriptInterpreter.interpret(Unknown Source)
at com.ibm.xsp.binding.javascript.JavaScriptMethodBinding.invoke(Unknown Source)
at com.ibm.xsp.component.UIIncludeComposite.initBeforePageContents(Unknown Source)
at com.ibm.xsp.page.compiled.AbstractCompiledPage.initComponent(Unknown Source)
at com.ibm.xsp.page.compiled.AbstractCompiledPage.createTree(Unknown Source)
at com.ibm.xsp.page.compiled.AbstractCompiledPage.addComponent(Unknown Source)
at com.ibm.xsp.component.UIIncludeComposite.buildContents(Unknown Source)
at com.ibm.xsp.page.compiled.AbstractCompiledPage.initComponent(Unknown Source)
at com.ibm.xsp.page.compiled.CompiledComponentBuilder.buildChildren(Unknown Source)
at com.ibm.xsp.page.compiled.CompiledComponentBuilder.buildAll(Unknown Source)
at com.ibm.xsp.component.UIViewRootEx.buildContents(Unknown Source)
at com.ibm.xsp.component.UIViewRootEx2.buildContents(Unknown Source)
at com.ibm.xsp.page.compiled.AbstractCompiledPage.initComponent(Unknown Source)
at com.ibm.xsp.page.compiled.AbstractCompiledPage.createTree(Unknown Source)
at com.ibm.xsp.page.compiled.AbstractCompiledPage.createViewRoot(Unknown Source)
at com.ibm.xsp.application.ViewHandlerExImpl._createViewRoot(Unknown Source)
at com.ibm.xsp.application.ViewHandlerExImpl.createViewRoot(Unknown Source)
at com.ibm.xsp.application.ViewHandlerExImpl.doCreateView(Unknown Source)
at com.ibm.xsp.application.ViewHandlerEx.createView(Unknown Source)
at com.ibm.xsp.webapp.FacesServlet.serviceView(Unknown Source)
at com.ibm.xsp.webapp.FacesServletEx.serviceView(Unknown Source)
at com.ibm.xsp.webapp.FacesServlet.service(Unknown Source)
at com.ibm.xsp.webapp.FacesServletEx.service(Unknown Source)
at com.ibm.xsp.webapp.DesignerFacesServlet.service(Unknown Source)
at com.ibm.designer.runtime.domino.adapter.ComponentModule.invokeServlet(Unknown Source)
at com.ibm.domino.xsp.module.nsf.NSFComponentModule.invokeServlet(Unknown Source)
at com.ibm.designer.runtime.domino.adapter.ComponentModule$AdapterInvoker.invokeServlet(Unknown Source)
at com.ibm.designer.runtime.domino.adapter.ComponentModule$ServletInvoker.doService(Unknown Source)
at com.ibm.designer.runtime.domino.adapter.ComponentModule.doService(Unknown Source)
at com.ibm.domino.xsp.module.nsf.NSFComponentModule.doService(Unknown Source)
at com.ibm.domino.xsp.module.nsf.NSFService.doServiceInternal(Unknown Source)
at com.ibm.domino.xsp.module.nsf.NSFService.access$0(Unknown Source)
at com.ibm.domino.xsp.module.nsf.NSFService$NsfServiceRequest.call(Unknown Source)
at com.ibm.domino.xsp.module.nsf.NSFService$NsfServiceRequest.call(Unknown Source)
at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source)
at java.util.concurrent.FutureTask.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
at com.ibm.domino.xsp.module.nsf.NSFService$NsfServiceThread.run(Unknown Source)

Answer 1

Is this in Domino 9.0.x?

In XPiNC the Java security settings are not managed by the server but on the relevant Notes Client. In the User Security settings, on the What Others Do > Using Workstation tab, for each signer a check box was added in R9 for "Load Java Code". This needs to be ticked for the signer of the XPiNC application.