-
Bug
-
Resolution: Cannot Reproduce
-
P4
-
None
-
8u66
-
x86_64
-
windows_7
FULL PRODUCT VERSION :
java version "1.8.0_66"
Java(TM) SE Runtime Environment (build 1.8.0_66-b17)
Java HotSpot(TM) Client VM (build 25.66-b17, mixed mode, sharing)
ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.1.7601]
EXTRA RELEVANT SYSTEM CONFIGURATION :
Using Internet Explorer 11 - Version 11.0.9600.18015
Using Firefox 41.0.2
Using 32 bit Java on 64 bit Windows 7.
A DESCRIPTION OF THE PROBLEM :
I have a web page A that starts an applet web page B. (This is so that the page B can close itself with an HTML button.) If I start page B directly I get no pop-up notice. If I start page B by means of page A I get a pop-up notice that reads:
Application Allowed by Deployment Rule Set
Name: com.worksoft.security.SecurityApplet
This is the ruleset.xml rule 1 message. This hash is the HSA-256 digest of the Worksoft Certifitate.
[OK]
This always happens in Internet Explorer. I'm not sure if it always happens in Firefox but I think so. Applets don't work well in Firefox these days because Firefox is set up to block them by default. If you change the settings they tend to revert to the default over time, so it's a bit hard to test in Firefox. In Chrome, of course, one can't run applets or I'd try it there.
ADDITIONAL REGRESSION INFORMATION:
This is fairly new behavior, as I remember. Since Java 1.8 doesn't allow me to run older versions of Java for Applets it makes it hard to determine when this last worked correctly. I am pretty sure that when I first wrote this code, Sept. 2014, I didn't have this problem.
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Run a web page in Internet Explorer that is similar to page B below. The notice should not appear if your system is working as mine does.
Shut down Internet Explorer and check the Task Manager to be sure that it has really, fully stopped. Terminate any processes that remain. (This should not be necessary.)
Run a web page in Internet Explorer that is similar to page A below. Notice that the useless notice appears and has to be cleared before the applet will run.
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The notice should either always appear or never appear, preferably never. Notify us if there's a problem, not if there is none.
ACTUAL -
The notice appears only when the applet page (B) is started from the non-applet page (A).
REPRODUCIBILITY :
This bug can be reproduced often.
---------- BEGIN SOURCE ----------
---- Page A: ----
<!DOCTYPE html>
<html>
<head>
<title>STARTER NO JNLP Security Test Applet Page</title>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js">
</script>
<script>
function open_window() {
window.open("file:///c:/a-Dev/Worksoft/Java-Interface/Java/JIBE/AppInterface/regression-tests/AppletSecurityTest/securityApplet-1_8.html");
}
</script>
</head>
<!-- -->
<body onload="open_window()">
<h1>NO JNLP Security Test Applet STARTER Page</h1>
<br/>
<h1>Be sure to allow pop-ups. (Firefox: Tools->Options->Content)</h1>
</body>
</html>
---- Page B: ----
<!DOCTYPE html>
<html>
<head>
<title>NO JNLP Security Test Applet Page</title>
<style>
button {width:120px; height:400px;}
</style>
<script>
// This will not work unless the tab is created through JavaScript. See the securityApplet-Starter-1_8.html
function close_window() {
close();
}
</script>
</head>
<!-- -->
<body>
<h1>NO JNLP Security Test Applet Page</h1>
<script src="https://www.java.com/js/deployJava.js"></script>
<table><tr><td>
<script>
var attributes = {code:'com.worksoft.security.SecurityApplet.class', archive:'securityApplet-1_8.jar', width:600, height:400};
var parameters = {fontSize:16, permissions:'all-permissions'};
deployJava.runApplet(attributes, parameters, '1.8');
</script>
</td><td>
<button id="myBtn" onclick="close_window();return false;"}>Close Tab</button>
</td></tr></table>
</body>
</html>
---- ruleset.xml: ----
<ruleset version="1.0+">
<rule>
<id>
<certificate algorithm="SHA-256" hash="E5:4F:5C:76:86:AA:47:67:A0:F1:25:14:68:9A:A0:CF:5E:CE:83:31:0B:EF:28:A9:8D:2E:D7:90:0D:92:93:25" />
</id>
<action permission="run" version="1.8.0_66" >
<message>This is the ruleset.xml rule 1 message. This hash is the SHA-256 digest of the Worksoft Certificate.</message>
</action>
</rule>
<!-- - -->
<rule>
<id location="http://docs.oracle.com/javase/tutorial/deployment/applet">
</id>
<action permission="run" version="1.8.0_66">
<message>This is the ruleset.xml rule 3 apple message.</message>
</action>
</rule>
<!-- - -->
<rule>
<id location="http://download.java.net">
</id>
<action permission="run" version="1.8.0_66">
<message>This is the ruleset.xml rule 4 apple message.</message>
</action>
</rule>
<!-- - -->
<!-- rule>
<id location="file:///c:/a-Dev/Worksoft/Java-Interface/Java/JIBE/AppInterface/regression-tests/AppletSecurityTest">
</id>
<action permission="run" version="1.8.0_66">
<message>This is the ruleset.xml rule 2 message.</message>
</action>
</rule -->
</ruleset>
---- NOTE: ----
You can supply the applet of your choice in page B or I can supply you with a jar file if needed.
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
Click the OK button.
java version "1.8.0_66"
Java(TM) SE Runtime Environment (build 1.8.0_66-b17)
Java HotSpot(TM) Client VM (build 25.66-b17, mixed mode, sharing)
ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.1.7601]
EXTRA RELEVANT SYSTEM CONFIGURATION :
Using Internet Explorer 11 - Version 11.0.9600.18015
Using Firefox 41.0.2
Using 32 bit Java on 64 bit Windows 7.
A DESCRIPTION OF THE PROBLEM :
I have a web page A that starts an applet web page B. (This is so that the page B can close itself with an HTML button.) If I start page B directly I get no pop-up notice. If I start page B by means of page A I get a pop-up notice that reads:
Application Allowed by Deployment Rule Set
Name: com.worksoft.security.SecurityApplet
This is the ruleset.xml rule 1 message. This hash is the HSA-256 digest of the Worksoft Certifitate.
[OK]
This always happens in Internet Explorer. I'm not sure if it always happens in Firefox but I think so. Applets don't work well in Firefox these days because Firefox is set up to block them by default. If you change the settings they tend to revert to the default over time, so it's a bit hard to test in Firefox. In Chrome, of course, one can't run applets or I'd try it there.
ADDITIONAL REGRESSION INFORMATION:
This is fairly new behavior, as I remember. Since Java 1.8 doesn't allow me to run older versions of Java for Applets it makes it hard to determine when this last worked correctly. I am pretty sure that when I first wrote this code, Sept. 2014, I didn't have this problem.
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Run a web page in Internet Explorer that is similar to page B below. The notice should not appear if your system is working as mine does.
Shut down Internet Explorer and check the Task Manager to be sure that it has really, fully stopped. Terminate any processes that remain. (This should not be necessary.)
Run a web page in Internet Explorer that is similar to page A below. Notice that the useless notice appears and has to be cleared before the applet will run.
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The notice should either always appear or never appear, preferably never. Notify us if there's a problem, not if there is none.
ACTUAL -
The notice appears only when the applet page (B) is started from the non-applet page (A).
REPRODUCIBILITY :
This bug can be reproduced often.
---------- BEGIN SOURCE ----------
---- Page A: ----
<!DOCTYPE html>
<html>
<head>
<title>STARTER NO JNLP Security Test Applet Page</title>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js">
</script>
<script>
function open_window() {
window.open("file:///c:/a-Dev/Worksoft/Java-Interface/Java/JIBE/AppInterface/regression-tests/AppletSecurityTest/securityApplet-1_8.html");
}
</script>
</head>
<!-- -->
<body onload="open_window()">
<h1>NO JNLP Security Test Applet STARTER Page</h1>
<br/>
<h1>Be sure to allow pop-ups. (Firefox: Tools->Options->Content)</h1>
</body>
</html>
---- Page B: ----
<!DOCTYPE html>
<html>
<head>
<title>NO JNLP Security Test Applet Page</title>
<style>
button {width:120px; height:400px;}
</style>
<script>
// This will not work unless the tab is created through JavaScript. See the securityApplet-Starter-1_8.html
function close_window() {
close();
}
</script>
</head>
<!-- -->
<body>
<h1>NO JNLP Security Test Applet Page</h1>
<script src="https://www.java.com/js/deployJava.js"></script>
<table><tr><td>
<script>
var attributes = {code:'com.worksoft.security.SecurityApplet.class', archive:'securityApplet-1_8.jar', width:600, height:400};
var parameters = {fontSize:16, permissions:'all-permissions'};
deployJava.runApplet(attributes, parameters, '1.8');
</script>
</td><td>
<button id="myBtn" onclick="close_window();return false;"}>Close Tab</button>
</td></tr></table>
</body>
</html>
---- ruleset.xml: ----
<ruleset version="1.0+">
<rule>
<id>
<certificate algorithm="SHA-256" hash="E5:4F:5C:76:86:AA:47:67:A0:F1:25:14:68:9A:A0:CF:5E:CE:83:31:0B:EF:28:A9:8D:2E:D7:90:0D:92:93:25" />
</id>
<action permission="run" version="1.8.0_66" >
<message>This is the ruleset.xml rule 1 message. This hash is the SHA-256 digest of the Worksoft Certificate.</message>
</action>
</rule>
<!-- - -->
<rule>
<id location="http://docs.oracle.com/javase/tutorial/deployment/applet">
</id>
<action permission="run" version="1.8.0_66">
<message>This is the ruleset.xml rule 3 apple message.</message>
</action>
</rule>
<!-- - -->
<rule>
<id location="http://download.java.net">
</id>
<action permission="run" version="1.8.0_66">
<message>This is the ruleset.xml rule 4 apple message.</message>
</action>
</rule>
<!-- - -->
<!-- rule>
<id location="file:///c:/a-Dev/Worksoft/Java-Interface/Java/JIBE/AppInterface/regression-tests/AppletSecurityTest">
</id>
<action permission="run" version="1.8.0_66">
<message>This is the ruleset.xml rule 2 message.</message>
</action>
</rule -->
</ruleset>
---- NOTE: ----
You can supply the applet of your choice in page B or I can supply you with a jar file if needed.
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
Click the OK button.