4

I maintain an Eclipse RCP application launched with WebStart. Java 7 u45 made some security changes, and now my application crashes on startup.

I've added to the manifest:

Permissions: all-permissions

Codebase: *

Trusted-Library: true

This removed all of the warning messages from the Control Panel. But I still have a classloader issue when trying to load my IApplication implemenentation, probably the first of my classes to load. This is new to update 45.

5
  • Did you try launching your application from the commandline using "javaws application.jnlp". I am also facing a similar issue with update 45 and if i run my app from command line it launches fine, but not from the browser. And yes, both of them are using the same java version.
    – Atul Soman
    Oct 17, 2013 at 15:04
  • I have a similar problem: I use a quite old version of the equinox launcher. After signing the JNLP (docs.oracle.com/javase/7/docs/technotes/guides/jweb/…), adding your manifest modifications and resigning my jars (also cf. blogs.oracle.com/java-platform-group/entry/what_to_do_if_your), WebStartMain reads the JARs and finds the osgi framework, but cannot find the EclipseStarter class at invokeFramework. I guess it's the installLocation that is wrong. If you find a solution, please report here.
    – sreg
    Oct 17, 2013 at 21:57
  • I already posted the solution below. Your problems are similar to this thread: stackoverflow.com/questions/17230773/….
    – ryvantage
    Oct 17, 2013 at 22:19
  • I also have a similar problem, I have removed security warnings with the answer provided at stackoverflow.com/questions/19393826/…, but my application still crashes on start-up. In Java WS Console I have set trace level to 5 and just before my application crashed I got these lines: network: Cache entry not found [url: localhost:80/C:/configuration/config.ini, version: null] network: Connecting localhost:80/C:/configuration/config.ini with proxy=DIRECT network: Connecting socket://localhost:80 with proxy=DIRECT
    – franz
    Oct 22, 2013 at 8:29
  • Do you see any error messages at your java debug console? What was your previous java version? Oct 24, 2013 at 15:49

3 Answers 3

3

I have experienced the same issue and managed to solve it by doing following:

In all manifest files (for each JAR in your RCP project) add these attributes:

Application-Name: My App Name
Permissions: all-permissions
Codebase: *
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
Trusted-Library: true

Second part of solution is to make jnlp properties secure by adding jnlp prefix. I have found solution here. You need to do this for framework properties (osgi, eclipse..) and for your properties E.g. instead of:

<property name="eclipse.product" value="com.amdosoft.oct.ui.product"/>
<property name="osgi.instance.area" value="@user.home/Application Data/myApp"/>
<property name="osgi.configuration.area" value="@user.home/Application Data/myApp"/>
<property name="my.App.property" value="someValue"/>

use

<property name="jnlp.eclipse.product" value="com.amdosoft.oct.ui.product"/>
<property name="jnlp.osgi.instance.area" value="@user.home/Application Data/myApp"/>
<property name="jnlp.osgi.configuration.area" value="@user.home/Application Data/myApp"/>
<property name="jnlp.my.App.property" value="someValue"/>

Download eclipse launcher with sources from here

In web start launcher you need to change back property names to old values (without jnlp prefix). You can do that by adding this part of source into main method of WebStartLauncher class.

Properties properties = System.getProperties();
// copy properties to avoid ConcurrentModificationException
Properties copiedProperties = new Properties();
copiedProperties.putAll(properties);
Set<Object> keys = copiedProperties.keySet();
for (Object key : keys) {
    if (key instanceof String) {
        String keyString = (String) key;
        if (keyString.startsWith("jnlp.")) {
            // re set all properties starting with the jnlp-prefix 
            // and set them without the prefix
            String property = System.getProperty(keyString);
            String replacedKeyString = keyString.replaceFirst("jnlp.", "");

            System.setProperty(replacedKeyString, property);
        }
    }
}

Export you new launcher as runnable JAR and put it in the same directory where your JNLP file is located.

Edit JNLP file by adding this line:

<jar href="myAppLauncher.jar"/>

inside tag and edit your application-desc tag like this:

<application-desc main-class="org.eclipse.equinox.launcher.WebStartMain">
  </application-desc>
0

When 7u25 came out, my application would crash with a classloader issue (sometimes, it was weird). The fix involved nixing my "Components.jnlp" deployment strategy. I had my library files in a separate .jnlp (Components.jnlp, as per a solution I read online back in 2010) and my main .jnlp (launch.jnlp) would load that .jnlp.

Now, it seems the Netbeans-generated .jnlp is sufficient and I no longer need any separate .jnlp for library components. I'm not sure if eclipse gives you an auto-generated .jnlp or not.

In the end, changing the launch.jnlp involved me having to give my clients a new installer that would load the new .jnlp onto their computers. It sucked but it worked.

Also, I'm not sure what Codebase: * is supposed to do. Why don't you just put your actual codebase in there?

If you did not deploy your app with that approach then this answer probably won't help. Might help somebody.

0

We've had multiple JNLP files up until now, and it seemed to work.

We install our app on customer internal networks, so we can't set a codebase other than * without resigning the entire set of jars for each customer.

2
  • Two things: 1) your "answer" looks like it should be a comment underneath my answer. 2) Wow, you deploy a separate .jar for the same program? Anyways, my point was: Oracle broke the contract for the JNLP ClassLoader. See this thread: stackoverflow.com/questions/17230773/…. It's a bug and Oracle has yet to fix it. I was just saying that MY way around was to undo my multiple-jnlp approach and go with the natural .jnlp that Netbeans generated for me.
    – ryvantage
    Oct 17, 2013 at 12:35
  • My reference to the Codebase: * was really a side question. I don't think you'll need to touch anything related to the Codebase for your solution. I think you just need to undo the Components.jnlp strategy to avoid the NPE in the ClassLoader.
    – ryvantage
    Oct 17, 2013 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.