signed applet throws security warning, but runs if yes button if clicked

Question

I have a signed applet that builds a menu from an xml file. When it loads I get the java security warning regarding signed and unsigned code. The applet uses jdom.jar

It doesn't matter if I hit yes on the security warning dialog box to block the unsigned code, or if I click no, the applet launches and runs as expected.

I have found out that a line of code in jdom that calls the SAXParserFactory.newInstance() is the cause of the security warning. I have tried signing jdom.jar, but that didn't help.

How can I get rid of the security warning without changing any settings in the Java console?

Thanks in advance.

@Bozho http://download.oracle.com/javase/6/docs/technotes/guides/jweb/mixed_code.html (If I was being really flippant http://www.google.co.uk/search?q=mixed-code .) — Tom Hawtin - tackline, Sep 09 '10 at 17:49

score 0 · Answer 1 · answered Sep 09 '10 at 15:40

You'll need to sign your entire applet if you use any of a list of features such as local file access or custom class loaders. The factory might use a custom class loader. The browser might not accept a self-signed certificate without a warning.

http://download.oracle.com/javase/1.4.2/docs/guide/plugin/developer_guide/rsa_signing.html

score 0 · Answer 2 · answered Sep 09 '10 at 15:58

0

Sign the JAXP jar (or the jar that contains SAXParserFactory)

answered Sep 09 '10 at 15:58

Bozho

588,226
146
1,060
1,140

I believe that jdom is using rt.jar in jre. I have tried using & signing other jar files that contain the SaxParserFactory, but it didn't help. What is interesting is that even if you press the yes button to block the unsigned code, the applet runs as expected. – user443545 Sep 09 '10 at 18:25
well, get the jaxp jar, sign it, and add it to the classpath :) – Bozho Sep 09 '10 at 18:29

score 0 · Answer 3 · answered Feb 22 '11 at 08:21

As the applet appears to work without the untrusted code, could you delete it? The untrusted code appears to be an alternate JAXP XML parser implementation. Hopefully the Xerces-based one in the JRE (since 1.4, IIRC), shouldn't be too bad.

(BTW: I would strongly recommend adding Trusted-Only: true to the manifest of your signed files, and Sealed: true isn't generally a bad idea.

signed applet throws security warning, but runs if yes button if clicked

3 Answers3