JDK-8076343 : JNLP property apple.laf.useScreenMenuBar no longer treated as secure for Mac OS
  • Type: Bug
  • Component: deploy
  • Sub-Component: plugin
  • Affected Version: 8u40
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • OS: os_x
  • CPU: x86
  • Submitted: 2015-03-25
  • Updated: 2015-09-29
  • Resolved: 2015-05-13
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u51 b13Fixed 9Fixed
Description
FULL PRODUCT VERSION :
Java Web Start 11.40.2.25
Using JRE version 1.8.0_40-b25 Java HotSpot(TM) 64-Bit Server VM

ADDITIONAL OS VERSION INFORMATION :
Mac OS X 10.9.3 (13D65)

EXTRA RELEVANT SYSTEM CONFIGURATION :
Mac Mini Late 2012
Firefox 36.0.1.

A DESCRIPTION OF THE PROBLEM :
Java application launched by unsigned dynamically-generated JNLP will run, but missing user interface features like menus, dialog boxes and response to function keys.

Missing features render application unusable to Mac OS X users.

Normally menus are enabled by setting apple.laf.useScreenMenuBar to true in resources section of JNLP.

As early as September 2010, this property was secure for Mac OS X but insecure for other OS. 

This leads me to believe there used to be a special build of Java for Mac OS X, and this issue may be a side-effect of an initiative to unify the codebase.

Maybe incomplete documentation led to oversight because no Apple properties are listed among "The following properties, as well as properties beginning..."

http://docs.oracle.com/javase/7/docs/technotes/guides/javaws/developersguide/syntax.html

POSSIBLE DUPLICATE: JDK-8075070
NOT DUPLICATE: JDK-8024720 (Has workaround, place property near top of resources section)


REGRESSION.  Last worked in version 8u31

ADDITIONAL REGRESSION INFORMATION: 
Java Web Start 11.31.2.13
Using JRE version 1.8.0_31-b13 Java HotSpot(TM) 64-Bit Server VM


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Launch application that needs menus with unsigned JNLP containing resource property apple.laf.useScreenMenuBar

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Application launches and menu interface appears
ACTUAL -
Application launches but missing menu interface.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Java Console shows:
Insecure property: (apple.laf.useScreenMenuBar, true) specified in unsigned jnlp file will not be set.

REPRODUCIBILITY :
This bug can be reproduced always.

CUSTOMER SUBMITTED WORKAROUND :
Revert user to prior version of Java 8 update 31 which is not affected.


SUPPORT :
YES
Comments
SQE OK to take low risk regression bug fix to CPU15_03
13-05-2015
Justification: This issue is caused due to incorrect synchronization of secure arguments in the Config.java file. One property - apple.laf.useScreenMenuBar is not added to the list of default secure properties. Risk Analysis: Low to no risk. Although we are adding a property to the list of secure properties, this should have been added long ago. It will not effect anything else. Crucible: https://java.se.oracle.com/code/cru/CR-JDK8UDEV-211 Testing: A Junit test case is added to cover this issue. A simple unsigned JNLP with the MenuBar property can be created to test this issue. Fix for release: 8u51, 8u60
12-05-2015
Crucible Review: https://java.se.oracle.com/code/cru/CR-JDK8UDEV-211
04-05-2015
This is not a duplicate of JDK-8074668, reassigning to deploy
31-03-2015
some doubt now if it's the same issue or not. mail thread at http://mail.openjdk.java.net/pipermail/awt-dev/2015-March/009114.html
26-03-2015
Looks like a duplicate of JDK-8074668 as per awt-dev thread on openjdk mailing list.
25-03-2015