JDK-6857588 : "java.lang.RuntimePermission createClassLoader" from Firefox 3.5 extension
  • Type: Bug
  • Component: deploy
  • Sub-Component: plugin
  • Affected Version: 6u14
  • Priority: P4
  • Status: Closed
  • Resolution: Not an Issue
  • OS: windows_xp
  • CPU: x86
  • Submitted: 2009-07-06
  • Updated: 2011-02-16
  • Resolved: 2009-08-04
Related Reports
Relates :  
Description
FULL PRODUCT VERSION :
java version "1.6.0_14"
Java(TM) SE Runtime Environment (build 1.6.0_14-b08)
Java HotSpot(TM) Client VM (build 14.0-b16, mixed mode, sharing)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Version 5.1.2600]

EXTRA RELEVANT SYSTEM CONFIGURATION :
Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1) Gecko/20090624 Firefox/3.5

Java Plug-in 1.6.0_11 for Netscape Navigator (DLL Helper)

A DESCRIPTION OF THE PROBLEM :
An exception is thrown when I do a "var cl = new java.net.URLClassLoader( [ xmldapUrl ] ��)" inside a Firefox extension. Those are expected to have the priveledge to create a classloader; how else should I load my jar files?

uncaught exception: Error calling method on NPObject! [plugin exception: java.security.AccessControlException: access denied (java.lang.RuntimePermission createClassLoader)].

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
- Start Firefox 3.5 and install openinfocard from here: http://openinfocard.googlecode.com/files/xmldap-0.9.9.200905172122.xpi
(Download the file to disk then drag it into a browser window.)
- Navigate to e.g. https://xmldap.org/relyingparty/
- click on the image
- look in the console for the error message

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
No exception should be thrown. A Firefox extension that wants to load jar files should be able to do this.
ACTUAL -
An exception is thrown when a class loader is created. The offending line is:
 var cl = new java.net.URLClassLoader( [ xmldapUrl ]  );
in file
http://code.google.com/p/openinfocard/source/browse/trunk/firefox/chrome/infocard/content/tokenissuerXul.js#50


ERROR MESSAGES/STACK TRACES THAT OCCUR :
uncaught exception: Error calling method on NPObject! [plugin exception: java.security.AccessControlException: access denied (java.lang.RuntimePermission createClassLoader)].

REPRODUCIBILITY :
This bug can be reproduced always.

Comments
EVALUATION Bug submitter has confirmed that the problem is not visible with the latest plugin.
04-08-2009

EVALUATION The bug description says it is using jre 1.6.0_14 but java plugin is 1.6.0_11. This permission issue was fixed in 1.6.0_12 under CR 6745455. I have verified that with the latest jre, the problem is not reproducible. Please double check with the bug submitter to run with the latest java plugin.
17-07-2009