Bug ID: JDK-6699613 Plugin2: bank's login applet throws NPE and fails to initialized

Type: Bug
Component: deploy
Sub-Component: plugin
Affected Version: 6u10

Priority: P3
Status: Closed
Resolution: Duplicate
OS: windows
CPU: x86

Submitted: 2008-05-09
Updated: 2010-04-04
Resolved: 2008-12-04

This CR is opened on behalf of the report on:
http://forums.java.net/jive/thread.jspa?threadID=40414&tstart=0

I am able to reproduce the problem with maybank's login applet: https://sslsecure.maybank.com.sg/cgi-bin/mbs/scripts/mbb_login.jsp
using latest 6u10 nightly build (dated 5/7/08) and FF3 or IE7.

Note that: maybank's login page loads fine with OJI Plugin on FF3 and IE7.

This bank's login page loads 2 applets: tmdisplay.class and encn2n.class.
With Plugin2, tmdisplay applet loaded fine.
But encn2n.class results in the following NPE during Applet.init():

java.lang.NullPointerExclogieption
	at encn2n.a(Unknown Source)
	at encn2n.init(Unknown Source)
	at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Plugin2Manager.java:1353)
	at java.lang.Thread.run(Thread.java:619)

JODE-ing the applet's source shows that during init(), encn2n applet tries to verify the user's login info against RSA keys. If initialization is successful, Applet.start() will set a status string to "OK". A stream of LiveConnect JS - J is continuously retrieving this status string from the applet and only proceed if the string received is "OK".

Since applet initialization fails, so does everything else.

Per the forum, maybank's login fails with 6u10 b14 and b23, but seems to work fine with b22.

Also per the forum's report, citibank's login applet also fails to work with b23:
https://www.citibank.com.sg/SGGCB/JSO/signon/DisplayCinSignon.do  

However, citibank works fine for me with latest 6u10.
I'll continue with the investigation.

EVALUATION The banking webpage is using js->java to call a method in the applet. The new java plugin introduced in 6u10 has a slight different behavior from the old plugin. In the new plugin, js->java call is allowin after applet init() method is completed, while in the old plugin, it is allowed after the applet start() call. The call to applet's getStatus() is invoked sometimes before the applet can return a "OK" status. This causes the applet disables the username/password fields.
04-12-2008
EVALUATION With the latest 6u12 nightly build running on XP and IE7, NPE is seen with the following applet https://sslsecure.maybank.com.sg/cgi-bin/mbs/scripts/mbb_login.jsp java console trace: PluginMain: processing JavaObjectOpMessage LiveConnectSupport: CALL_METHOD "getStatus" basic: PERF: AppletExecutionRunnable - applet.init() BEGIN ; jvmLaunch dt 169180 us, pluginInit dt 3304586 us, TotalTime: 3473766 us NonMacintosh-v1.5 - rel 1.0 basic: Removed progress listener: sun.plugin.util.GrayBoxPainter$GrayBoxProgressListener@704baa java.lang.NullPointerException Applet2ClassLoader: Policy.getPolicy() took 0 ms basic: Applet loaded. at encn2n.a(Unknown Source) at encn2n.init(Unknown Source) at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Plugin2Manager.java:1445) at java.lang.Thread.run(Unknown Source) Exception: java.lang.NullPointerException Ignored exception: java.lang.NullPointerException basic: Applet resized and added to parent container ... and later another NPE... basic: Told clients applet is started Exception occurred during CALL_METHOD getStatus: java.lang.RuntimeException: java.lang.NullPointerException at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo.doObjectOp(LiveConnectSupport.java:562) at sun.plugin2.main.client.LiveConnectSupport$PerAppletInfo$LiveConnectWorker.run(LiveConnectSupport.java:1594) at java.lang.Thread.run(Unknown Source) There's no issue running the citibank applet: https://www.citibank.com.sg/SGGCB/JSO/signon/DisplayCinSignon.do
23-10-2008
EVALUATION Posted request for access to applet source code on http://forums.java.net/jive/thread.jspa?threadID=40414&tstart=0 in order to proceed.
22-05-2008
EVALUATION The NPE thrown in user's Applet.init() code is what preventing the applet and LiveConnect to operate properly. I've tried to Jode, Jad, and Mocha the applet code, but since the src is rather large with many packages and classes, the decompiled result is not very useful for debugging purpose. Simply debugging by reading the decompiled code does not show any suspicious area where NPE can be thrown. I noticed that applet encn2n.class is specified with width=height=0, however, I've tried download the src and jsp to run locally with modified width & height to non-zero values but that didn't help. Will ask the forum for access to src code.
19-05-2008