JDK-7036967 : javax.jnlp.BasicService.showDocument() throws SecurityException for trusted app
  • Type: Bug
  • Component: deploy
  • Sub-Component: webstart
  • Affected Version: 6u24
  • Priority: P2
  • Status: Closed
  • Resolution: Duplicate
  • OS: solaris_10
  • CPU: sparc
  • Submitted: 2011-04-15
  • Updated: 2012-03-20
  • Resolved: 2011-04-15
Related Reports
Duplicate :  
Description
FULL PRODUCT VERSION :
>java -version
java version "1.6.0_24"
Java(TM) SE Runtime Environment (build 1.6.0_24-b07)
Java HotSpot(TM) Client VM (build 19.1-b02, mixed mode, sharing)


EXTRA RELEVANT SYSTEM CONFIGURATION :
Microsoft Windows [Version 5.2.3790]

A DESCRIPTION OF THE PROBLEM :
We use javax.jnlp.BasicService.showDocument(String) from a signed JNLP-Application (signed by VeriSign) to launch another JNLP application from a local file.
With java 1.6.0_23 this succeeds, but since 6u24 this fails with a security exception.


REGRESSION.  Last worked in version 6

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Launching a jnlp application from a local jnlp-file:

final String location = "file://" + path_to_my_jnlp_file;
final BasicService basicService = (BasicService) ServiceManager.lookup("javax.jnlp.BasicService");
if (basicService.isWebBrowserSupported()) {
    basicService.showDocument(location);
}


EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Launch of the requested jnlp application.
ACTUAL -
Security exception

ERROR MESSAGES/STACK TRACES THAT OCCUR :
java.lang.SecurityException: ShowDocument url permission denied
	at com.sun.jnlp.BasicServiceImpl.showDocument(BasicServiceImpl.java:102)
	at ...



REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
final String location = "file://" + path_to_my_jnlp_file;
final BasicService basicService = (BasicService) ServiceManager.lookup("javax.jnlp.BasicService");
if (basicService.isWebBrowserSupported()) {
    basicService.showDocument(location);
}

---------- END SOURCE ----------