JDK-8077649 : jnlp "codebase" attribute has been made mandatory
  • Type: Bug
  • Component: deploy
  • Sub-Component: webstart
  • Affected Version: 7u25,8,9
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2015-04-13
  • Updated: 2015-09-29
  • Resolved: 2015-04-17
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u60 b15Fixed 9Fixed
Description
Since the implementation of JDK-6924099 in 7u25 (also backported to 6u51 and all later releases) a minimal jnlp file such as:
<jnlp>
   <resources>
      <jar href="http://oklahoma.us.oracle.com/www/tests/sandbox/hello.jar" />
   </resources>
 <application-desc main-class="hello"/>
</jnlp>
will throw an NPE.
This is because JNLPClassLoader.getPermissions() was modified to call LaunchDesc.getCodebase().getHost() to get the download host.
note jnlp specification does not require codebase if all resources are fully qualified.
also note - before jnlp spec version 8.20, information descriptor with title and vendor was required, since then it is optional.

The fix is quite simple, LaunchDownload uses mainJar.getLocation().getHost() as the download host.
other option is to not grant URLPermissions to codesource URL unless codebase is defined.

same problem does not apply to plugin since codebase is implicitly defined as docbase when codebase is not specified in jnlp file.