CODEWITHSUNDEEP
javasecurityapplet
Sam Sirry
Sam Sirry

Reputation: 772

What a webpage java applet can access on my computer?

So, how much trust do I need to have in a publisher before I run their applet in the web browser?

In other words, I understand that a java applet is run in a sandbox in the browser, but this article suggests that the applet can actually access files stored on the local computer.

Can you please clarify the security limits of a java applet run in a modern browser, such as Firefox 50?

Upvotes: 0

Views: 617

Answers (1)

Andrew Thompson
Andrew Thompson

Reputation: 168845

I understand that a java applet is run in a sandbox in the browser, but this article suggests that the applet can actually access files stored on the local computer.

There are potentially three different levels of security available to a Java applet.

  1. The first is as you described 'sandboxed'. They can only access resources from their own server, nothing on your local file system unless they are launched using Java Web Start & will thereby have access to the services of the JNLP API.

    You might note that two of the services are the FileOpenService / FileSaveService! If the applet goes to use these, the end user will be prompted to permit the action via a dialog that states what the applet is trying to do, and asking for permission to proceed (to show a file chooser & go from there). These services provide back a 'file like' object that is more limited than the normal File API would supply. For example, it will not provide the path to the resource, just it's name and access to the content.
  2. The level up from that can be specified in the launch file - '(J2EE) application client permissions'. This level removes the prompts for use of the JNLP API services.
  3. The highest level of access is obtained by requesting, and being granted, 'all permissions'. Then the applet should have full access to File objects, be able to communicate with servers other than the one that launched it, etc. One of the few things they would still not be permitted to do in this mode is to call System.exit(n) to effectively 'kill the JRE' - this is something that is commonly done in other desktop apps.

But then there are JRE bugs, that screw all that up. Sun, then Oracle, kept stuffing up security so poorly (& regularly) that many browser manufacturers are entirely removing the support for applets (and other embedded objects requiring plug-ins) in web pages.

See Java Plugin support deprecated and Moving to a Plugin-Free Web for more detail.

..how much trust do I need to have in a publisher before I run their applet in the web browser?

I cannot answer for you, but my take would be that I would need to know them personally, and trust completely both their integrity and competence before I'd run their code in any browser I controlled.

Having said that, I don't think I have a single browser installed that even supports applets, and my complete lack of motivation to set something up, is probably a good view on whether I'd allow applets to run on this PC at all.

Upvotes: 3

Related Questions