Re: [appengine-java] Security problem with App Engine application

John Patterson Fri, 03 Sep 2010 01:23:33 -0700

You can write a local Java application that reads data using the JDBCdriver and inserts it into your datastore using the RemoteDatastorelibrary:


http://code.google.com/p/remote-datastore/

I use this code to read local data from a CSV file and "push" it toeither my local App Engine environment for development or theproduction environment.


On 2 Sep 2010, at 22:28, Andy Faulkner wrote:

Hi,

I'm trying to develop an AppEngine application in Java, that will read
some values from a local MSSQL database on our internal network using
Microsoft's JDBC driver, and then insert those values into a reference
spreadsheet in our Google Docs domain.

I'm falling at the first hurdle!

I have Eclipse Helios, with Version 1.3.7 of the App Engine SDK Plugin
installed.

So, I create a new App Engine project (HelloWorld) and when I run
this, it works just fine.

And then, just to get things going, I have modified the doGet method
so that it looks like this (I'm expecting that this will extract some
records from my database, and then print them to the HTML page) - just
want to get things going before I really get to work.


@SuppressWarnings("serial")
public class VisionConnectorServlet extends HttpServlet {
        public void doGet(HttpServletRequest req, HttpServletResponse resp)
                        throws IOException {


                resp.setContentType("text/plain");

                // Declare the JDBC objects.
              Connection con = null;
              Statement stmt = null;
              ResultSet rs = null;

              try {
                 // Establish the connection.
                 Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");

                 SQLServerDataSource ds = new SQLServerDataSource();
                 ds.setUser("DeltekVision");
                 ds.setPassword("Password1");
                 ds.setServerName("server02");
                 ds.setPortNumber(1433);
                 ds.setDatabaseName("vision2");
                 con = ds.getConnection();

                 String SQL = "SELECT * FROM CL where status='A'";
                 stmt = con.createStatement();
                 rs = stmt.executeQuery(SQL);

                 // Iterate through the data in the result set and display
it.
                 while (rs.next()) {
                        resp.getWriter().println("Client: " + 
rs.getString("Name"));
                        resp.getWriter().println("<br/>");
                 }
              }

              // Handle any errors that may have occurred.
              catch (Exception e) {
                 e.printStackTrace();
              }
              finally {
                 if (rs != null) try { rs.close(); } catch(Exception e) {}
                 if (stmt != null) try { stmt.close(); } catch(Exception e)
{}
                 if (con != null) try { con.close(); } catch(Exception e) {}
                 System.exit(1);
              }

        }

When I run the application the Jetty server fires up as expected (so
everything builds OK) but when I access the web page, kaboom:

java.security.AccessControlException: access denied
(java.net.SocketPermission cccccc:1433 connect,resolve)
        at

java.security.AccessControlContext.checkPermission(AccessControlContext.java:

323)
        at
java.security.AccessController.checkPermission(AccessController.java:
546)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:
532)
        at com.google.appengine.tools.development.DevAppServerFactory
$CustomSecurityManager.checkPermission(DevAppServerFactory.java:166)
        at java.lang.SecurityManager.checkConnect(SecurityManager.java:1034)
        at

com.microsoft.sqlserver.jdbc.SQLServerConnectionSecurityManager.checkConnect(SQLServerConnection.java:

3229)
        at

com.microsoft.sqlserver.jdbc.ServerPortPlaceHolder.doSecurityCheck(FailOverInfo.java:

144)
        at

com.microsoft.sqlserver.jdbc.ServerPortPlaceHolder.<init>(FailOverInfo.java:

135)
        at

com.microsoft.sqlserver.jdbc.SQLServerConnection.primaryPermissionCheck(SQLServerConnection.java:

968)
        at

com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:

800)
        at

com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:

700)
        at

com.microsoft.sqlserver.jdbc.SQLServerDataSource.getConnectionInternal(SQLServerDataSource.java:

593)
        at

com.microsoft.sqlserver.jdbc.SQLServerDataSource.getConnection(SQLServerDataSource.java:

57)
        at

com.integrity.visionconnector.VisionConnectorServlet.doGet(VisionConnectorServlet.java:

31)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:693)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:806)
        at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:
511)
        at org.mortbay.jetty.servlet.ServletHandler
$CachedChain.doFilter(ServletHandler.java:1166)
        at

com.google.appengine.api.blobstore.dev.ServeBlobFilter.doFilter(ServeBlobFilter.java:

58)
        at org.mortbay.jetty.servlet.ServletHandler
$CachedChain.doFilter(ServletHandler.java:1157)
        at

com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter(TransactionCleanupFilter.java:

43)
        at org.mortbay.jetty.servlet.ServletHandler
$CachedChain.doFilter(ServletHandler.java:1157)
        at

com.google.appengine.tools.development.StaticFileFilter.doFilter(StaticFileFilter.java:

122)
        at org.mortbay.jetty.servlet.ServletHandler
$CachedChain.doFilter(ServletHandler.java:1157)
        at
org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:
388)
        at

org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:

216)
        at
org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:
182)
        at
org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:
765)
        at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:
418)
        at

com.google.apphosting.utils.jetty.DevAppEngineWebAppContext.handle(DevAppEngineWebAppContext.java:

70)
        at
org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:
152)
        at com.google.appengine.tools.development.JettyContainerService
$ApiProxyHandler.handle(JettyContainerService.java:349)
        at
org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:
152)
        at org.mortbay.jetty.Server.handle(Server.java:326)

atorg.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:

542)
        at org.mortbay.jetty.HttpConnection
$RequestHandler.headerComplete(HttpConnection.java:923)
        at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:547)
        at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:212)
        at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404)
        at

org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:

409)
        at org.mortbay.thread.QueuedThreadPool
$PoolThread.run(QueuedThreadPool.java:582)
02-Sep-2010 16:24:42 com.google.apphosting.utils.jetty.JettyLogger
warn
WARNING: /visionconnector
java.security.AccessControlException: access denied
(java.lang.RuntimePermission exitVM.1)
        at