JDK-6709916 : Add property sun.lang.ClassLoader.allowArraySyntax=true to the list of secure porperties
  • Type: Enhancement
  • Component: deploy
  • Sub-Component: webstart
  • Affected Version: 6
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: windows_xp
  • CPU: x86
  • Submitted: 2008-06-03
  • Updated: 2014-01-23
  • Resolved: 2010-09-09
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 7
7Resolved
Related Reports
Duplicate :  
Relates :  
Description
FULL PRODUCT VERSION :
java version "1.6.0"
Java(TM) SE Runtime Environment (build 1.6.0-b105)
Java HotSpot(TM) Client VM (build 1.6.0-b105, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Windows XP

A DESCRIPTION OF THE PROBLEM :
I am trying to run the following test application via Java WebStart with java 1.6 and I am getting NoClassDefFoundError exception even when row <property name="sun.lang.ClassLoader.allowArraySyntax" value="true" /> is included into JNLP file:

public class TestApp{
public static void main(String args[]) throws Exception{
System.out.println(ClassLoader.getSystemClassLoader().loadClass("[Ljava.lang.Object;"));
}
} 

With java 1.5 this "app" does working fine.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Add property <property name="sun.lang.ClassLoader.allowArraySyntax" value="true" /> into JNLP file and run the following app:

public class TestApp{
public static void main(String args[]) throws Exception{
System.out.println(ClassLoader.getSystemClassLoader().loadClass("[Ljava.lang.Object;"));
}
} 

There will be NoClassDefFoundError thrown.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
This app does working fine with Java WebStart with java 1.5 so I expect this app runs without errors under Java WebStart with java 1.6

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
public class TestApp{
public static void main(String args[]) throws Exception{
System.out.println(ClassLoader.getSystemClassLoader().loadClass("[Ljava.lang.Object;"));
}
} 
---------- END SOURCE ----------

Release Regression From : 5.0
The above release value was the last known release where this 
bug was not reproducible. Since then there has been a regression.

Comments
EVALUATION First, the reason why the customer test application: public class TestApp{ public static void main(String args[]) throws Exception{ System.out.println(ClassLoader.getSystemClassLoader().loadClass("[Ljava.lang.Object;")); } } needs the property (sun.lang.ClassLoader.allowArraySyntax=true) to be set in 1.6 in order to work has nothing to do with java web start. Even running the above as standalone java application has the same problem: with 6.0: C:\6709916>"c:\Program Files\java\jdk1.6.0\bin\java" test SystemClassLoader: sun.misc.Launcher$AppClassLoader@d9f9c3 Exception in thread "main" java.lang.ClassNotFoundException: [Ljava.lang.Object; at java.net.URLClassLoader$1.run(URLClassLoader.java:200) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:188) at java.lang.ClassLoader.loadClass(ClassLoader.java:306) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:276) at java.lang.ClassLoader.loadClass(ClassLoader.java:251) at test.main(test.java:4) with 5.0: C:\6709916>"c:\jdk1.5.0\bin\java" test SystemClassLoader: sun.misc.Launcher$AppClassLoader@133056f class [Ljava.lang.Object; I am not familiar with the property "sun.lang.ClassLoader.allowArraySyntax" myself. But in order for the customer testApp to work in java 6, it looks like we need the property set. For adding "sun.lang.ClassLoader.allowArraySyntax" to the safe java system property list for JNLP, we will need to talk to the JVM team and the security team and see if it is okay to do so.
05-08-2008

WORK AROUND In order for the property to have effect, the property must be set with -D when the JVM starts. So in order to do that for jnlp application, they should use the jnlp property tag, combined with using a "signed" jnlp file. This way, the property will be set during JVM startup. In the jnlp file, they can set the property: <property name="sun.lang.ClassLoader.allowArraySyntax" value="true"/> and then do a signed JNLP file. Basically a JNLP file is signed by including a copy of it in the signed main JAR file. The copy must match the JNLP file used to launch the application. The signed copy must be named: JNLP-INF/APPLICATION.JNLP. The APPLICATION.JNLP filename should be generated in upper case. You can refer to the JNLP specification, section 5.4.1 for more information. I tried with 6u10, and it works. This way, you don't need to touch the deployment.properties file on every client machines.
05-08-2008

EVALUATION when the property is set, in 6.0, JNLPClassLoader extends URLClassLoader, and java.net.URLClassLoader throws: java.lang.ClassNotFoundException: [Ljava.lang.Object; but on 1.5.0, we extend SecureClassLoader directly, and it returns w/o exception: class [Ljava.lang.Object yet call is to GetSystemClassLoader ? tests are staged at: http://web-east.east/www/tests/1.6.0_10/6709916/
16-06-2008