2

We're using Firefox 18.0.1 deployed in a kiosk-type environment to run a signed applet. Both the JDK and the JRE are JavaSE 7u11. The signed jar lets us do all the things that a sandboxed applet normally can't do for its users (wander the local disk, talk to printers, steal all their pr0n, etc).

The applet and the page that loads it conspire to generate some HTML and JavaScript; the JavaScript and the applet then talk back and forth in a mostly-seamless fashion. Sometimes the applet creates popup dialogs; these are either triggered by the user clicking on a Java component, or triggered by the user clicking on some HTML widget with an "onclick" script that tells the applet to make a dialog.

In the last week, I've noticed something wonky about some of the applet's popup dialogs. They have a tiny warning icon hanging outside the dialog box:

tiny little bang

The icon is glued to the dialog if the user moves it. Hovering over the icon pops a little "Java Applet Window" tooltip, which is especially interesting because not all of our dialogs appear with it.

The window shown in that snapshot was created with this test code. (Yes, there are shorter ways to use JOptionPane, but then it wouldn't replicate our actual code. Some of the dialogs are more customized than others.)

import java.awt.BorderLayout;

import javax.swing.JApplet;
import javax.swing.JDialog;
import javax.swing.JLabel;
import javax.swing.JOptionPane;
import javax.swing.JPanel;
import javax.swing.SwingUtilities;

public class WhereTheHellDoesTheIconComeFrom
{
    private JPanel topPanel;

    public WhereTheHellDoesTheIconComeFrom (JApplet applet) {
        // Multiple panels with a text blob in each
        JLabel exampleText = new JLabel ("some text here", JLabel.CENTER);
        topPanel = new JPanel (new BorderLayout(5,0));
        topPanel.add (exampleText, BorderLayout.CENTER);

        // Create the options pane.
        Object allpanels[] = new Object[] {
            topPanel,
        };
        Object buttons[] = { "B1", "B2" };

        JOptionPane optionPane = new JOptionPane (allpanels,
            JOptionPane.PLAIN_MESSAGE,
            JOptionPane.OK_CANCEL_OPTION,
            null,   // no icon built in
            buttons,
            buttons[0]);  // select this button by default

        // Ask it for the visible popup.
        JDialog dialog = optionPane.createDialog(
            SwingUtilities.getWindowAncestor(applet),
            "This is the title text");
        dialog.setResizable(false);
        dialog.setDefaultCloseOperation(JDialog.DISPOSE_ON_CLOSE);
        dialog.pack();
        dialog.setLocationRelativeTo(null);
        dialog.setVisible(true);
        // Modal dialog blocks on the previous line; at this point I can
        // examine getValue() and make decisions, etc, etc.
    }
}

I've spent about an hour cuddling up with Google in the hopes it might reveal something to me, but I can't find any mention of this out there. Is this a Firefox thing or a JRE thing? Or, better question: what's causing the warning icon to appear on some dialogs and not others?

4
  • 2
    This is a firefox thing.
    – fmodos
    Jan 22, 2013 at 22:50
  • @fmodos I'd suggest making that an answer if you could provide additional information (and make your answer longer ;)) Jan 22, 2013 at 23:10
  • opss... my mistake, I had done a very quick read in this post and missed the part where he says that it only happens from HTML event, anyway I just did a quick research and the link below seems to have a workaround for this problem. coderanch.com/t/416408/Applets/java/…
    – fmodos
    Jan 22, 2013 at 23:46
  • @fmodos Good link, thanks! They seem to have taken the "polling-esque" approach, where the insecure thread sets flags for the secured thread to test and respond to. It's a common alternative to the use of PrivilegedExceptionAction, but I don't know why using a priv'd action didn't solve the problem for them in the first place like it did for me.
    – Ti Strga
    Jan 23, 2013 at 15:08

1 Answer 1

1

Well, now I feel silly. I've been playing with this for a couple of hours, got nowhere, posted the question here, went to get my 14th cup of coffee, and then the answer came to me while stirring in the cream. Here's the difference:

Popups triggered directly from the user clicking on signed applet widgets are "normal".

Popups triggered from the user clicking on an HTML/JavaScript object, and the 'onclick' script calling a signed Java function, are flagged with a warning.

Anytime a javascript function calls into a signed applet, the applet is treated as unsigned for the length of the call. This is probably a similar precaution taking effect, but I haven't actually verified that. The solution is the same in both cases: find the smallest stretch of code that requires "no really this is safe I mean it" status, and wrap a PrivilegedExceptionAction around it. Or at least, that's the correct solution for other javascript-into-signed-applet calls, so I tried it here and it worked. :-)

In our real code, the part that shows the dialog (from createDialog onwards) is in its own function. Replacing the call to that function with AccessController.doPrivileged() and a wrapped call to that function takes care of everything. No more warning icon!

1
  • Good question. Well researched answer. Glad you got it sorted. :) Jan 23, 2013 at 3:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.