1. 首頁
  2. 問答
  3. Java JRE混合代碼安全性，從JRE開始1.6.0_19

Java JRE混合代碼安全性，從JRE開始1.6.0_19

2013-04-02 79 views
1

Java JRE混合代碼安全性，從JRE 1.6.0_19開始並在 最初在2010年左右，使用JDK/JRE 1.6實施，構建和部署主jar Java Applet .0_12;主要的罐子和第三方罐子都簽了名，一切正常。主jar jar applet和第三方jar可以在JRE 1.6.0_12到JRE 1.6.0_18下正常工作。Java JRE混合代碼安全性，從JRE開始1.6.0_19

但是，隨着以JRE 1.6.0_19開頭的混合代碼安全性的引入，主jar將不會隨JRE 11.6.0_27一起啓動，除非混合代碼安全性被禁用。
我們正在將我們的JRE從1.6.0_12移動到更新27.我試圖解決這個問題，也就是說，當啓用混合代碼安全性時，允許簽名的主jar Java applet和簽名的第三方jar啓動。

我有一個主jar包含Java Applet源代碼和幾個由主jar使用的第三方jar;例如，activation.jar，log4j-1.2.13.jar，ojdbc14.jar等。

在JDK 1.6.0_27中使用keytool.exe我創建了一個新的密鑰庫，該密鑰庫具有用於Java的私鑰/公鑰對小程序。在JDK 1.6.0_27中使用jarsigner.exe，我成功地用私鑰對主jar和所有第三方jar進行了簽名;每個jar都有一個簽名文件.SF和一個簽名塊文件.DSA（數字簽名算法）。我導出了用於驗證簽名罐子的公鑰。

Java Applet和第三方JAR位於Web應用程序的webcontent/applet目錄中，當使用Web應用程序啓動該小程序時，主jar和第三方JAR會下載到用戶的計算機中。數字簽名部分工作正常，當JRE混合代碼安全性被禁用時，Java applet能夠成功啓動和工作。這在啓用時仍然無法解決混合代碼安全問題。

我試着將主jar部署爲Trusted-Only和Trusted-Library。在啓用混合代碼安全性的兩種情況下，主jar Java Applet無法啓動，我得到不同的例外，但得到相同的結果。

Trusted-Only :: Mixed Code Enable 
......................... 
cache: Mark prevalidated: http://hostname:port/path/main.jar true tm=numbers cert=numbers 
security: http://hostname:port/path/main.jar is newly asserting Trusted-Only 
basic: Plugin2ClassLoader.getPermissions CeilingPolicy allPerms 
security: Validate the certificate chain using CertPath API 
security: The certificate hasnt been expired, no need to check timestamping info 
security: Cannot find jurisdiction list file 
security: The CRL support is disabled 
security: The OCSP support is disabled 
security: This OCSP End Entity validation is disabled 
security: Checking if certificate is in Deployment denied certificate store 
security: Checking if certificate is in Deployment permanent certificate store 
basic: Embedding dialogs not enabled in Configuration 
basic: Plugin2ClassLoader.getPermissions CeilingPolicy allPerms 
......................... 
......................... 
network: Cache entry not found [url: http://hostname:port/path/StatLib.jar, version:  null] 
network: Connecting http://hostname:port/path/StatLib.jar with proxy=DIRECT 
network: Connecting http://hostname:port/ with proxy=DIRECT 
network: Connecting http://hostname:port/path/StatLib.jar with cookie  "CheckboxChecked=Y; JSESSIONID=j_session_id" 
network: CleanupThread used 1 us 
network: Downloading resource: http://hostname:port/path/StatLib.jar 
Content-Length: 62,219 
Content-Encoding: null 
network: Wrote URL http://hostname:port/path/StatLib.jar to File C:\path\LocalLow\Sun\Java\Deployment\cache\6.0\24\167b0298-1365f142-temp 
security: Trusted libraries list file not found 
cache: Create from verifier: JarSigningData{hasOnlySignedEntries=true, hasSingleCodeSource=true, hasMissingSignedEntries=false} 
cache: Adding MemoryCache entry: http://hostname:port/path/StatLib.jar 
basic: Plugin2ClassLoader.isTrustedByPolicy called 
basic: Plugin2ClassLoader.isTrustedByPolicy returns false 
security: resource name "com/name/statistics/lib/I_Dispatch.class" in  http://hostname:port/path/StatLib.jar : java.lang.SecurityException: Trusted-Only loader attempted to load sandboxed resource from http://hostname:port/path/StatLib.jar 
04/01/2013 16:58:41,588 - [FATAL Thread-15 com.lfg.name.JavaObjectName.init(JavaName.java:193)] - Error in Method() java.lang.SecurityException: Trusted-Only loader attempted to load sandboxed resource from http://hostname:port/path/StatLib.jar 
at com.sun.deploy.security.CPCallbackHandler$ParentCallback.check(Unknown Source) 
at com.sun.deploy.security.CPCallbackHandler$ParentCallback.access$1500(Unknown Source) 
at com.sun.deploy.security.CPCallbackHandler$ChildElement.checkResource(Unknown Source) 
at com.sun.deploy.security.DeployURLClassPath$JarLoader.checkResource(Unknown Source) 
at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(Unknown Source) 
at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(Unknown Source) 
at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader$2.run(Unknown Source) 
at java.security.AccessController.doPrivileged(Native Method) 
at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Unknown Source) 
at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source) 
at java.lang.ClassLoader.loadClass(Unknown Source) 
at java.lang.ClassLoader.defineClass1(Native Method) 
at java.lang.ClassLoader.defineClass(Unknown Source) 
at java.security.SecureClassLoader.defineClass(Unknown Source) 
at java.net.URLClassLoader.defineClass(Unknown Source) 
at sun.reflect.GeneratedMethodAccessor11.invoke(Unknown Source) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
at java.lang.reflect.Method.invoke(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.defineClassHelper(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.access$100(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader$2.run(Unknown Source) 
at java.security.AccessController.doPrivileged(Native Method) 
at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Unknown Source) 
at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source) 
at java.lang.ClassLoader.loadClass(Unknown Source) 
at java.lang.Class.forName0(Native Method) 
at java.lang.Class.forName(Unknown Source) 
.... Java Applet is calling and loading a class in a third party jar that I signed but for some reason is been treated as unsigned .... 
....................... 
network: Cache entry not found [url: http://hostname:port/path/ojdbc14.jar, version: null] 
network: Connecting http://hostname:port/path/ojdbc14.jar with proxy=DIRECT 
network: Connecting http://hostname:port/ with proxy=DIRECT 
network: Connecting http://hostname:port/path/ojdbc14.jar with cookie "CheckboxChecked=Y; JSESSIONID=j_session_id" 
network: CleanupThread used 1 us 
network: Downloading resource: http://hostname:port/path/ojdbc14.jar 
Content-Length: 1,448,790 
Content-Encoding: null 
network: Wrote URL http://hostname:port/path/ojdbc14.jar to File C:\path\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\534fe7f3-21a4d4ae-temp 
security: Trusted libraries list file not found 
cache: Create from verifier: JarSigningData{hasOnlySignedEntries=true, hasSingleCodeSource=true, hasMissingSignedEntries=false} 
network: CleanupThread used 1 us 
cache: Adding MemoryCache entry: http://hostname:port/path/ojdbc14.jar 
basic: Plugin2ClassLoader.isTrustedByPolicy called 
basic: Plugin2ClassLoader.isTrustedByPolicy returns false 
security: resource name "oracle/jdbc/driver/OracleDriver.class" in http://hostname:port/path/ojdbc14.jar : java.lang.SecurityException: Trusted-Only loader attempted to load sandboxed resource from http://hostname:port/path/ojdbc14.jar 
java.lang.SecurityException: Trusted-Only loader attempted to load sandboxed resource from http://hostname:port/path/ojdbc14.jar 
at com.sun.deploy.security.CPCallbackHandler$ParentCallback.check(Unknown Source) 
at com.sun.deploy.security.CPCallbackHandler$ParentCallback.access$1500(Unknown Source) 
at com.sun.deploy.security.CPCallbackHandler$ChildElement.checkResource(Unknown Source) 
at com.sun.deploy.security.DeployURLClassPath$JarLoader.checkResource(Unknown Source) 
at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(Unknown Source) 
at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(Unknown Source) 
at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader$2.run(Unknown Source) 
at java.security.AccessController.doPrivileged(Native Method) 
at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Unknown Source) 
at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source) 
at java.lang.ClassLoader.loadClass(Unknown Source) 
..... java applet is loaded a java class in a third party jar that was signed, but is been treated as untrusted..... 

Trusted-Library :: Mixed Code Enable 
.............................. 
cache: Mark prevalidated: http://hostname:port/path/main.jar true tm=numbers cert=numbers 
basic: Plugin2ClassLoader.getPermissions CeilingPolicy allPerms 
security: Validate the certificate chain using CertPath API 
security: The certificate hasnt been expired, no need to check timestamping info 
security: Cannot find jurisdiction list file 
security: The CRL support is disabled 
security: The OCSP support is disabled 
security: This OCSP End Entity validation is disabled 
security: Checking if certificate is in Deployment denied certificate store 
security: Checking if certificate is in Deployment permanent certificate store 
basic: Embedding dialogs not enabled in Configuration 
basic: exception: java.lang.NoClassDefFoundError: org/apache/log4j/Logger. 
java.lang.RuntimeException: java.lang.NoClassDefFoundError: org/apache/log4j/Logger 
at com.sun.deploy.uitoolkit.impl.awt.AWTAppletAdapter.instantiateApplet(Unknown Source) 
at sun.plugin2.applet.Plugin2Manager.initAppletAdapter(Unknown Source) 
at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source) 
at java.lang.Thread.run(Unknown Source) 
Caused by: java.lang.NoClassDefFoundError: org/apache/log4j/Logger 
at com.path.MainClassApplet.init(MainClassApplet.java:line_number) 
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) 
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) 
at java.lang.reflect.Constructor.newInstance(Unknown Source) 
at java.lang.Class.newInstance0(Unknown Source) 
at java.lang.Class.newInstance(Unknown Source) 
at com.sun.deploy.uitoolkit.impl.awt.AWTAppletAdapter$1.run(Unknown Source) 
at java.awt.event.InvocationEvent.dispatch(Unknown Source) 
at java.awt.EventQueue.dispatchEventImpl(Unknown Source) 
at java.awt.EventQueue.access$200(Unknown Source) 
at java.awt.EventQueue$3.run(Unknown Source) 
at java.awt.EventQueue$3.run(Unknown Source) 
at java.security.AccessController.doPrivileged(Native Method) 
at java.security.ProtectionDomain$1.doIntersectionPrivilege(Unknown Source) 
at java.security.ProtectionDomain$1.doIntersectionPrivilege(Unknown Source) 
at java.awt.EventQueue$4.run(Unknown Source) 
at java.awt.EventQueue$4.run(Unknown Source) 
at java.security.AccessController.doPrivileged(Native Method) 
at java.security.ProtectionDomain$1.doIntersectionPrivilege(Unknown Source) 
at java.awt.EventQueue.dispatchEvent(Unknown Source) 
at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source) 
at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source) 
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source) 
at java.awt.EventDispatchThread.pumpEvents(Unknown Source) 
at java.awt.EventDispatchThread.pumpEvents(Unknown Source) 
at java.awt.EventDispatchThread.run(Unknown Source) 
Caused by: java.lang.ClassNotFoundException: org.apache.log4j.Logger 
at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source) 
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source) 
at java.lang.ClassLoader.loadClass(Unknown Source) 
... 27 more 
Ignored exception: java.lang.RuntimeException: java.lang.NoClassDefFoundError: org/apache/log4j/Logger 
basic: Dialog type is not candidate for embedding 
basic: Removed progress listener: [email protected] 
security: Reset deny session certificate store

主要罐子小應用程序（富互聯網應用）是使用JavaScript代碼中的JavaServer Pages文件（HTML頁面）用HTML代碼調用。

這是我的理解是，JavaScript代碼被視爲未簽名的代碼。當從HTML頁面中的JavaScript代碼訪問已簽名的小程序時，已簽名的小程序將在安全沙箱中執行。這意味着簽名的applet本質上就像一個未簽名的applet。

我在辯論是否應該使用帶有Deployment Tookit（deployJava.js）的JNLP來部署小程序，或者如果我應該將類添加到主JAR文件的清單文件中的主JAR文件的類路徑中;其清單引用了不同的JAR文件（或幾個不同的JAR文件），這些JAR文件充當我的小程序用途的實用程序。

關於如何解決這個混合代碼問題的任何想法？

請指教，謝謝。

來源

2013-04-02 Gibran E Castillo

+0

我解決了這個問題，方法是在Applet的jar manifest.mf文件中添加Class-Path屬性中的所有簽名的第三方jar文件，並在「archive」中添加.JSP頁面標籤中的所有第三方jar。屬性，最後列出並加載小程序jar。 –

回答

0

我可以確認問題是最近的JRE。從JS調用Java將給你一個「混合代碼警告」。無論你是如何簽署或包含或不包含哪個圖書館。 因此，上述評論不再真實或不真實（在最新的JRE升級之後，我正在使用1.7.0_21）。

但幸運的是它仍然允許從Java調用做的JavaScript沒有問題，所以我們來到了此類問題的解決方案是實現多數民衆贊成正在從applet的輪詢的commad隊列，如下所示：

1）包裹每一次調用到小程序的方法在「請求對象」，並把它在隊列中，例如：

var jobQueue = []; 

function hello(message) { 
    request = { 
    cmd:"hello", 
    arg:"Jack", 
    callback:function(result) { 
     alert("I'm saying "+result); 
    } 
    } 
    jobQueue.push(request); 
}

2）創建的方法從該小程序調用以獲取作業：

function fetchJob(){ 
    if (jobQueue.length>0) { 
    return jobQueue.shift(); 
    } 
}

3）當小程序啓動時，產生一個線程或一個計時器，每X毫秒將調用函數fetchJob。當函數返回一個非空請求時，applet可以執行。可攜帶（如上面的例子）的請求，甚至回調被調用來返回結果

這就是全部。但要小心：如果您使用回調來返回結果，請注意不要從本地對象中返回任何內容，否則您將再次以混合代碼警告結束。即使是一串字符串也不行。如果您需要創建更復雜的結果，則需要使用liveconnect API回調JavaScript，並從Java Applet創建本機JS對象，然後使用該對象調用回調。

祝你好運！

來源

2013-04-18 15:58:33

+0

Varitibolius：你是對的，它不適用於JRE 1.7.0_21和更新的版本，比如JRE 1.7.0_45。我會嘗試你用「命令隊列」建議的。謝謝！ –

相關問題

 相關問題