Java Applet problem | Security Exception

Newbie & Debugging Questions
#1

So I have no clue how to fix this.
The problem is that I have this applet, which has canvas. I use that canvas as a parent to LWJGL’s display. It works perfectly when I run it as applet in eclipse. When I create a jar file and put it into a html file and try to run the web page, the applet works like shit.

When I run in eclipse, it works like it should. Canvas’s addnotify method is called, then start method is called. Once I close the applet, stop method is called and removenotify afterwards.

When I try to run it in web page, addnotify is called, then start, and removenotify once I start the page. I don’t close it or anything, it just gets called right after start method.

I have no idea why this happens. Any help would be awesome.

Here is the html code:

<html>
<applet code="com.chrisindiegames.game.GameApplet.class" archive="game.jar" width="800" height="600">
</applet>
</html>

After long frustrating hours I seem to have found the problem. No idea how I found it, but here is the exception.

Exception in thread "Thread-46" java.security.AccessControlException: access denied ("java.util.PropertyPermission" "user.dir" "read")
	at java.security.AccessControlContext.checkPermission(Unknown Source)
	at java.security.AccessController.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkPermission(Unknown Source)
	at sun.plugin2.applet.AWTAppletSecurityManager.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
	at java.lang.System.getProperty(Unknown Source)
	at java.io.Win32FileSystem.getUserPath(Unknown Source)
	at java.io.Win32FileSystem.resolve(Unknown Source)
	at java.io.File.getAbsolutePath(Unknown Source)
	at com.chrisindiegames.game.Natives.load(Natives.java:13)
	at com.chrisindiegames.game.Game.init(Game.java:39)
	at com.chrisindiegames.game.GameApplet$2.run(GameApplet.java:61)

The problem seems to be with permissions, access rights or something like that. Does anyone know how to fix this? To be exact, here is the line that the error occurs:

File f = new File("nat");
		String path = f.getAbsolutePath();
#2

Anybody knows how to fix dis? :confused:

#3

Here’s a read about applet’s security model

http://docs.oracle.com/javase/tutorial/deployment/applet/security.html

#4

Ow man… This is so frustrating… I’m looking for a tutorial on how to “sign an applet” and can’t find anything that would explain stuff normally… I was reading this page and I was really excited, because it seemed to be just the thing I needed:
http://www-personal.umich.edu/~lsiden/tutorials/signed-applet/signed-applet.html
I finally get to the end of and where the real “stuff” starts. And at the second sentence I’m like WTF

Use the jar JDK utility.

How am I supposed to understand what that is?? Who writes these tutorials?
I will probably give up on trying to make an applet out of my game…

#5

Create a keystore using the keytool command:

http://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html

Using the keystore created, you need to sign the JAR with the jarsigner command:

http://docs.oracle.com/javase/tutorial/deployment/jar/signing.html

#6

Note however, that Oracle has plans to block self-signed Applets. Unsigned are already blocked or at least behind a wall of red warnings.

#7

Indeed, everyone that updates java somewhere after January will not be able to run your applet anymore if you sign it yourself. If you need those permissions you’ll have two options:

  1. Make it a downloadable application instead of an applet
  2. Purchase a certificate for around 100 dollar per year (http://codesigning.ksoftware.net/)

Mike

#8

Really… Than why am I wasting my time. I’m not going to pay for my applets for my little games…

#9

Applets had been fading already for some years, and the past year too man yhackers exploited security holes in the java applet runtime. I think many people have disabled the java applet in their browsers anyways meanwhile, so it doesn’t have the reach anymore that it once had.

Just make it a java application. On windows your can make *.jar files start automatically on double click (and I think on other OSes it should work too, if you have a modern desktop). That’s about as convenient as an *.exe file for the user.

#10

In general all NPAPI plugins, including the Java Applet plugin (except for maybe Flash) are pretty much dead and its only going to get worse as browser makers push HTML5/Javascript.

In any event if you must continue with Java Applets you could give LWJGL’s AppletLoader a go, its pre-signed with a proper certificate and will let you use your unsigned jars (provided you only use the LWJGL API’s and Java API’s available in sandbox mode). However wait for the LWJGL 2.9.1 release (should be any day now) as it contains fixes for problems introduced in Java 7u45.

#11

Says if you have the JDK (which you obviously do), it should be in your java bin folder (an application called Jarsigner)

#12

There is a reason why I spend the little spare time I have on creating a downloadable auto updating launcher for my game instead of actually working on the game…

For some games that will indeed do the trick, but in his case it won’t help seeing as he wants to go outside of the sandbox (or he wouldn’t have gotten a security exception :))

Mike

#13

Direct access to the file-system and system properties throw a security exception. However, depending what You want to do, system properties might not be important (I, for example, was trying to ask for java version, in an applet, I just don’t) and file access, there might be alternatives.

Note, that applets are still useful if You want to do a quick demo of Your work to ppl who trust You. For larger distribution, it’s not the best option anymore, but still an option.
For larger distribution, there are better options. For java, there are also open source launchers available, like: https://github.com/threerings/getdown