Signed Java Applet access denied java.io.FilePermission read

Question

I created a java applet for e-signature . Applet runs normal and works perfectly while i am running on ide (intelliJ) . But when i deployed project to .jar file and tried to run on browser (firefox) i got some error saying that .jar is untrusted. Then i made some researches and signed my applet with jarsigner . I follewed these steps :

keytool -genkey -keyalg rsa -alias MyCert
keytool -certreq -alias MyCert
jarsigner C:\TestApplet.jar MyCert

also tried commands at oracle web site .link here

After i signed my applet error gone and i could run my applet. But when i try to sign a file i got an error saying that applet dont have permision to access cert store folder. Error is :

java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Users\ChooseClick.sertifikadeposu" "read")

Correct. After many security vulnerabilities were found, applets (even signed applets) are not given permission to the cert store folder. — Elliott Frisch, Jan 16 '16 at 18:47
So do i have any thing to do. I can maybe install lower java version ? :( — salih baki sayer, Jan 16 '16 at 18:59
Don't use applets. You could install a lower firefox version, but then it's vulnerable to exploit. — Elliott Frisch, Jan 16 '16 at 19:09
if i dont use applet i cannot access to usb drive and certificate from browser and user cannot sign a file. — salih baki sayer, Jan 16 '16 at 19:12
Sounds like you need a different architecture. [Don't use applets](http://programmers.blogoverflow.com/2013/05/why-cs-teachers-should-stop-teaching-java-applets/). — Elliott Frisch, Jan 16 '16 at 19:15
I understand that applets are bad but there is no way other than using applets :/. I cannot access to hardware without applet — salih baki sayer, Jan 16 '16 at 19:34

score 0 · Answer 1 · answered Jan 17 '16 at 02:14

I found the solution. To able to access files or any other restricted action at java , you must use prilivaged blocks :

    AccessController.doPrivileged(new PrivilegedAction() {
    public Object run() {
       //actions that need permission goes here

        return null;
    }
  });

you can use this block in any function.

Signed Java Applet access denied java.io.FilePermission read

1 Answers1