United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-6691503 Malicious applet can show always-on-top popup menu which has whole screen size
JDK-6691503 : Malicious applet can show always-on-top popup menu which has whole screen size

Details
Type:
Bug
Submit Date:
2008-04-21
Status:
Resolved
Updated Date:
2011-01-19
Project Name:
JDK
Resolved Date:
2008-04-30
Component:
client-libs
OS:
generic
Sub-Component:
javax.swing
CPU:
generic
Priority:
P3
Resolution:
Fixed
Affected Versions:
7
Fixed Versions:

Related Reports
Relates:
Relates:
Relates:

Sub Tasks

Description
There is an oversight in the fix for 6675802. It allows a malicious applet to show an always-on-top popup menu which has the whole screen size. A code example is below:
=== Source Begin ===
import javax.swing.*;
import java.awt.*;

public class MaliciousApplet extends JApplet {
    public void start() {
        JPopupMenu popupMenu = new JPopupMenu();
        popupMenu.add(new JMenuItem("Click"));

        Dimension screenSize = Toolkit.getDefaultToolkit().getScreenSize();
        popupMenu.setPopupSize(screenSize);

        popupMenu.show(null, 0, 0);
    }
}
=== Source End ===

                                    

Comments
EVALUATION

The changes in the Popup class added by the fix for 6580930 were intended for allowing a popup menu to overlap the Windows task bar. It is important for tray icons. However, popup menus in applets don't need to overlap the task bar. Hence, setAlwaysOnTop() in the Popup class can be called only for applications, but not for applets.

The fix idea is to avoid calling setAlwaysOnTop() in the Popup class for applets, but do it for standalone applications.
                                     
2008-04-21
EVALUATION

In general it is not easy to determine whether one is running in the context of an applet as opposed to an application.
                                     
2008-04-21
EVALUATION

OK, we can always try to do setAlwaysOnTop() and catch the exception for applets. I think, it shouldn't slow down the code noticeably.
                                     
2008-04-22
SUGGESTED FIX

src/share/classes/javax/swing/Popup.java
@@ -227,19 +227,16 @@
             setFocusableWindowState(false);
             setName("###overrideRedirect###");
             // Popups are typically transient and most likely won't benefit
             // from true double buffering.  Turn it off here.
             getRootPane().setUseTrueDoubleBuffering(false);
-            java.security.AccessController.doPrivileged(
-                    new java.security.PrivilegedAction<Object>() {
-                        public Object run() {
+            try {
                             setAlwaysOnTop(true);
-                            return null;
+            } catch (SecurityException se) {
+                // igonre
                         }
                     }
-            );
-        }
 
         public void update(Graphics g) {
             paint(g);
         }
                                     
2008-04-22
WORK AROUND

There are no workarounds.
                                     
2008-04-23



Hardware and Software, Engineered to Work Together