illegal remote socket connection allowed

walter.bays@Eng 1997-04-07
I am able to open a socket connection to a remote host in Netscape.
Security restrictions applied in different cases seem inconsistent.

The applet is at http://perfwww.eng/tasks/commuting/index-traffic.html
The source code is linked from "about this applet".
Note that I am trying to catch security exceptions caused by the
socket connection to www.kron.com and display a dialog box warning people
not to use Netscape, and what security settings to use with appletviewer
and hotjava. I'm not necessarily doing it correctly. I compiled originally
with JWS 1.0 (JDK 1.0.1) but have recompiled with the javac in S2.6_b30
(JDK 1.1.X). The code uses deprecated API's. I'm running it on various
1.0.1 and 1.1 based JVM's.

The table below summarizes the applet's behavior:

Client->Server s->f f->f f->p p->f p->p

Browser Security
appletviewer none U W* U U U
                host D W* D D D
                unrestricted W W W W W
hotjava untrusted U U U U U
                high** W W U W W
                medium A A A A W*
netscape - D W* D D D

Key

U fails with Uncaught exception
D fails, and displays my Dialog frame with explanation
W works
A hotjava dialog asks whether to allow the attempted connection
        after answering YES it works
* surprise that this works
** either the f->p case should work or all the others should fail

        Name OS appletviewer hotjava Netscape
s sho 2.6_29b /bin /usr/dt/bin /usr/dist
f fuzja 2.6_30 /bin /usr/dt/bin /usr/dist
p perfwww 2.5.1 /usr/dist /usr/dist /usr/dist

fuzja is running an Apache http server
perfwww is running a Netscape http server

To try it out yourself, copy the html file and classes to your own client
machine which is also running an http server. You can also access these
files in /net/perfwww/home1/www/tasks/commuting/