We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

How to read/write a file to client from an applet?

pierreandersson
on
Medium Priority
391 Views
Last Modified: 2013-12-29
Hello.

I have programmed an applet that reads a file from the clients computer(the applet is accessed trough Explorer 4.0
and the applet is on a webserver), the applet uses a FileInputStream to read the file from the client computer. I know that this is not permitted but i have signed the applet with low so i have full permissions, i used the signcode and cabarc tool from Microsoft. My problem is that i still got the JavaSecurityException(see below). What must i do to make it work. I want the applet to read my file and write it back to the clients computer without the JavaSecurityException.

com.ms.security.SecurityExceptionEx[Host]: cannot access file p.zip
      at com/ms/security/permissions/FileIOPermission.check (FileIOPermission.java)
      at com/ms/security/PolicyEngine.deepCheck (PolicyEngine.java)
      at com/ms/security/PolicyEngine.checkPermission (PolicyEngine.java)
      at com/ms/security/StandardSecurityManager.chk (StandardSecurityManager.java)
      at com/ms/security/StandardSecurityManager.checkRead (StandardSecurityManager.java)
      at java/io/FileInputStream.<init> (FileInputStream.java)
      at ZipApp1.Unpackzip (ZipApp1.java)
      at ZipApp1.init (ZipApp1.java)
      at com/ms/applet/AppletPanel.securedCall0 (AppletPanel.java)
      at com/ms/applet/AppletPanel.securedCall (AppletPanel.java)
      at com/ms/applet/AppletPanel.processSentEvent (AppletPanel.java)
      at com/ms/applet/AppletPanel.processSentEvent (AppletPanel.java)
      at com/ms/applet/AppletPanel.run (AppletPanel.java)
      at java/lang/Thread.run (Thread.java)
com.ms.security.SecurityExceptionEx[Host]: cannot access file p.zip
      at com/ms/security/permissions/FileIOPermission.check (FileIOPermission.java)
      at com/ms/security/PolicyEngine.deepCheck (PolicyEngine.java)
      at com/ms/security/PolicyEngine.checkPermission (PolicyEngine.java)
      at com/ms/security/StandardSecurityManager.chk (StandardSecurityManager.java)
      at com/ms/security/StandardSecurityManager.checkRead (StandardSecurityManager.java)
      at java/io/FileInputStream.<init> (FileInputStream.java)
      at ZipApp1.Unpackzip (ZipApp1.java)
      at ZipApp1.init (ZipApp1.java)
      at com/ms/applet/AppletPanel.securedCall0 (AppletPanel.java)
      at com/ms/applet/AppletPanel.securedCall (AppletPanel.java)
      at com/ms/applet/AppletPanel.processSentEvent (AppletPanel.java)
      at com/ms/applet/AppletPanel.processSentEvent (AppletPanel.java)
      at com/ms/applet/AppletPanel.run (AppletPanel.java)
      at java/lang/Thread.run (Thread.java)
Microsoft (R) VM for Java (tm), 4.0 Release 4.79.0.2613
==============================================
?  help
c  clear
f  run finalizers
g  garbage collect
m  memory usage
q  quit
t  thread list
==============================================
 
Comment
Watch Question

Commented:
Java Report Online has a good article describing how to sign applets for both browsers. It is located at
http://www.javareport.com/features/9802/sommers.html

Make sure you've followed all the right steps for signing and using applets in MS Explorer.

Author

Commented:
Now have read the article, but it wont still work, i don't think that the exception is because of the signing because the certificate window is appearing and i have to submit a yes if i am accepting the applet, can't it be in the code, is there another way to load the file instead of FileInputStream(String filename).

Commented:
This is a standard way to do it. There are others like RandomAccessFile, but if the first one fails, the others will probably fail too. So you have to solve the security issue first.

Author

Commented:
I send you the way i did the signing, maybe you can se some error in the steps i did it.

1. makecert -sk PierreKey -n "CN=PubTest" PierreCert.cer

2. cert2spc PierreCert.cer PierreCert.spc

3. cabarc n App1.cab App1.class

4. signcode -j javasign.dll -jp medium -spc PierreCert.spc -k PierreKey App1.cab

5. chkjava App1.cab


My applet is on a webserver. I use a explorer 4.0 on a Internet connected computer. The applet tries to load the file from my Internet connected computer.

If you wan't to try the applet go to www.konsult.net/javalab/javazip/zipapp.html


Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
I have tried this to but it won't work, it gives me the same error. It is very strange because it seems that i have dont the right thing when i am signing the cab files, can it be the
rights on the file or something like that?

Commented:
Could you provide a piece of code which gives you trouble?

Author

Commented:
Here is the code i think it is this code that gives me problem FileInputStream in =  new FileInputStream("p.zip"); The program does execute in the dos window as an application.

public void Unpackzip()
      {

try {
      
      
FileInputStream in =  new FileInputStream("p.zip");

                  ZipInputStream zi = new ZipInputStream(in);
             
                  FileOutputStream fo = null;
                  
            
                  
                  ZipEntry ze = new ZipEntry("");
                  
      
              

                  
try {            
                while ((ze = zi.getNextEntry())!=null)
                  {
                  String path = new String();
                  String filename = new String();
                filename=filename+path+ze.getName();
                filename = filename.replace('/',File.separatorChar);
                System.out.println("HELLO: "+filename);
                  File destFile = new File(filename);
                      
                        System.out.println("1  "+filename);
                  if (destFile.exists())
                  {
                  System.out.println("OW Not implemented");
                  // Owerwrite
                  
                  }
                  else
                  {
                        System.out.println("27");
                  String parent = destFile.getParent();
                  
                  if (parent!=null)
                  {
                  File parentFile = new File(parent);
                  if (!parentFile.exists())
                  {
                  System.out.println("Makedir");
                  parentFile.mkdirs();
                  }
                  }
                  
                  System.out.println("Innan fo");
                        fo = new FileOutputStream(filename);
           
      System.out.println(ze.getSize()+"   "+ze.getName());
                        
                  while (x < ze.getSize())
                  {      
                        len = zi.read(bArr,0,256);
            
                fo.write(bArr, 0, len);      
                x = x + len;
               }
               x = 0;
         
                           
                        
                        
                  }

}
System.out.println("2");
 in.close();
// fo.close();      
      } catch (ZipException zipex) { System.out.println("Invalid archive!!!"); }


 
 


                  
                  
                  
            }      catch (IOException ioe) {System.out.println(ioe.toString());}
      
      
      


      
      }

Commented:
Code looks ok. What happens if you sign you applet for low security? What if you turn the browser zone to trusted (with low security)? If the browser security is higher than applet's security it should prompt you for permission which it does, right? Does it say that the applet is signed and allows you to view your signing certificate? If it does not, the problem may be in signing.

Author

Commented:
Can the securityexception be that i have a testcertificate?

Commented:
It shouldn't really. If you have a test certificate it should be obvious for anyone who wants to look at your certificate (and thus may want to deny permission) but the program should not care.

Commented:
I am having exactly the same problem, except that I have a VeriSign Class 2 certificate and private key.  I see the certificate in the window, but I get the same exception.  By the way there is a really good FAQ here...

http://www.suitable.com/Doc_CodeSigning.shtml#explorer

Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.