[
https://issues.apache.org/jira/browse/FELIX-4281?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14019160#comment-14019160
]
Rob Walker edited comment on FELIX-4281 at 6/5/14 8:03 PM:
-----------------------------------------------------------
Karl
It goes a little deeper than that I believe. The dexfile stuff is one instance
of the root problem. If you patch around that code (which I have) you hit the
next instance of the same problem, which occurs when registering URLHandlers.
Both of these cases use Class.forName() calls - which are documented in several
articles as problematic in a JNLP environment where the JNLP classloader is
being used.
So at present, I now have 2 cases which cause the same problem. What I've yet
to find is a common solution. The 1st one (the dexfile case) can be gotten
around with a simple property check - even though I don't believe that's the
right solution. The second one I'll dig more into tomorrow - getting late here!
_Edit:_ I should add, I don't believe the dexfle case goes back into the felix
extension url handling, I think it's a standalone case. The stack trace (below)
shows no Felix classes after BundleWiringImpl.
That said, I think the URLHandlers one is the nastier and trickier one to try
and deal with
===
"Thread-15" #51 prio=6 os_prio=0 tid=0x000000002ba37000 nid=0x228c in
Object.wait() [0x000000002a89a000]
java.lang.Thread.State: WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at java.lang.Object.wait(Unknown Source)
at com.sun.javaws.ui.JavawsSysRun.delegate(Unknown Source)
- locked <0x00000005c0f987e8> (a java.lang.Object)
at com.sun.deploy.util.DeploySysRun.execute(Unknown Source)
at com.sun.deploy.util.DeploySysRun$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.deploy.util.DeploySysRun.executePrivileged(Unknown Source)
at com.sun.deploy.ui.UIFactory.showPublisherInfo(Unknown Source)
at
com.sun.deploy.uitoolkit.impl.awt.ui.UIFactoryImpl.showPublisherInfo(Unknown
Source)
at com.sun.deploy.security.SandboxSecurity.showBlockedDialog(Unknown
Source)
- locked <0x00000005c141c9e0> (a java.lang.Object)
at com.sun.deploy.security.SandboxSecurity.checkRunUntrusted(Unknown
Source)
at
com.sun.deploy.security.SandboxSecurity.checkUnsignedSandboxSecurity(Unknown
Source)
- locked <0x00000005c142ebe0> (a com.sun.deploy.util.SessionProperties)
at com.sun.deploy.security.SandboxSecurity.isPermissionGranted(Unknown
Source)
at com.sun.javaws.security.AppPolicy.grantRestrictedAccess(Unknown
Source)
at com.sun.javaws.security.AppPolicy.addPermissions(Unknown Source)
at com.sun.jnlp.JNLPClassLoader.getTrustedCodeSources(Unknown Source)
at
com.sun.deploy.security.CPCallbackHandler$ParentCallback.strategy(Unknown
Source)
at
com.sun.deploy.security.CPCallbackHandler$ParentCallback.openClassPathElement(Unknown
Source)
- locked <0x00000005c0f1f390> (a
com.sun.deploy.security.CPCallbackHandler$ParentCallback)
at com.sun.deploy.security.DeployURLClassPath$UrlLoader.<init>(Unknown
Source)
at com.sun.deploy.security.DeployURLClassPath$3.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
- locked <0x00000005c0f1f160> (a
com.sun.deploy.security.DeployURLClassPath)
at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown
Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at com.sun.jnlp.JNLPClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
- locked <0x00000005c0f1dfc0> (a com.sun.jnlp.JNLPClassLoader)
at java.lang.ClassLoader.loadClass(Unknown Source)
- locked <0x00000005c0f1df48> (a com.sun.jnlp.JNLPClassLoader)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Unknown Source)
at
org.apache.felix.framework.BundleWiringImpl.<clinit>(BundleWiringImpl.java:1339)
at
org.apache.felix.framework.StatefulResolver.markResolvedRevisions(StatefulResolver.java:990)
at
org.apache.felix.framework.StatefulResolver.resolve(StatefulResolver.java:429)
at org.apache.felix.framework.Felix.init(Felix.java:692)
at com.ascert.vt.launch.VtLauncher.launchFelix(VtLauncher.java:1011)
at com.ascert.vt.launch.VtLauncher.launchProfile(VtLauncher.java:983)
at com.ascert.vt.launch.VtLauncher.start(VtLauncher.java:675)
at
com.ascert.vt.launch.VersionCheckLaunchPanel$2.run(VersionCheckLaunchPanel.java:161)
at java.lang.Thread.run(Unknown Source)
===
was (Author: walkerr):
Karl
It goes a little deeper than that I believe. The dexfile stuff is one instance
of the root problem. If you patch around that code (which I have) you hit the
next instance of the same problem, which occurs when registering URLHandlers.
Both of these cases use Class.forName() calls - which are documented in several
articles as problematic in a JNLP environment where the JNLP classloader is
being used.
So at present, I now have 2 cases which cause the same problem. What I've yet
to find is a common solution. The 1st one (the dexfile case) can be gotten
around with a simple property check - even though I don't believe that's the
right solution. The second one I'll dig more into tomorrow - getting late here!
> Security Warning: Felix with Java Web Start
> -------------------------------------------
>
> Key: FELIX-4281
> URL: https://issues.apache.org/jira/browse/FELIX-4281
> Project: Felix
> Issue Type: Bug
> Environment: Windows 7 with Java 7 update 40, 64 bits
> Reporter: Cesar Souza
> Priority: Minor
> Attachments: message.zip, viewer.jnlp
>
>
> Since the release of Java 7 update 40 the following warning occurs when you
> try to execute a signed (with valid certificate) Java Web Start application:
> -----------------------------
> Security Warning
> Do you want to run this application?
> An unsigned application from the location below is requesting permission to
> run.
> http://......
> Running unsigned applications like this will be blocked in a future
> release because it is potentially unsafe and a security risk
> -----------------------------
> Although the Java recognizes the certificate in the first dialog, it shows
> the warning message when the Felix's init method is invoked.
> I have tested a same application over Java 7 update 21 and everything is ok.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
