Problems with applet for displaying desktop app's output

Discussion in 'Java' started by Paul, Aug 15, 2009.

  1. Paul

    Paul Guest

    All,

    I inherited a desktop C++ (VC6) application that uses the user's web
    browser for output. When the system first wants to display output it
    writes a temporary html file, fires up the web browser with an html
    page with an applet that opens a socket that listens for messages on a
    particular port. The C++ app then sends the temp file name through the
    socket for the applet to display. When new output comes along the new
    file name gets sent through the socket and the applet updates the web
    page (so all of this work is just so that you don't get a new web page
    for each output). It uses a similar mechanism to display help (sending
    the relevant section number through the socket). The relevant Java
    looks something like this:
    m_serverSocket = new ServerSocket(m_theApp.m_port);
    and then later
    clientSocket = m_serverSocket.accept();
    Recently the java people decided that connecting to localhost is a
    security risk (see http://sunsolve.sun.com/search/document.do?assetkey=1-66-246387-1),
    so that this accept() now throws a security exception. I'm trying to
    fix this but I'm not getting anywhere. Here are the things I've tried
    and decided doesn't work (feel free to point out mistakes or
    misunderstandings on my side, I'm a noob at java):
    1) I changed the C:\Program Files\Java\jre6\lib\security\java.policy
    file to add "accpet" for localhost:
    permission java.net.SocketPermission "localhost:1024-",
    "listen,accept";
    this works, but I can't use this because a) it isn't safe, b) we
    don't want users to have to change their java.policy files and
    obviously the installer can't do it
    for them.
    2) I don't want to sign the applet because this will be really
    confusing to users (why should they be asked to trust anything from a
    desktop app that doesn't even do
    anything over the net?)
    3) I've tried passing a command line parameter to the applet in order
    for it to use an "application" specific policy file, but it seems that
    an applet can't take
    the -Djava.security.policy command line parameter.
    4) I've read that unsigned applets can (only) open sockets back to the
    server from which it was loaded, but I'm not using a web server so
    there is no server URL (and
    localhost doesn't work).

    I'm out of ideas but would love to hear some!

    Paul
    Paul, Aug 15, 2009
    #1
    1. Advertising

  2. In article
    <>,
    Paul <> wrote:
    [...]
    > http://sunsolve.sun.com/search/document.do?assetkey=1-66-246387-1

    [...]
    > 1) I changed the C:\Program Files\Java\jre6\lib\security\java.policy
    > file to add "accpet" for localhost: permission
    > java.net.SocketPermission "localhost:1024-", "listen,accept"; this
    > works, but I can't use this because a) it isn't safe, b) we don't
    > want users to have to change their java.policy files and obviously
    > the installer can't do it for them.
    > 2) I don't want to sign the applet because this will be really
    > confusing to users (why should they be asked to trust anything from a
    > desktop app that doesn't even do anything over the net?)


    I think you should consider signing the applet. Even though it's from
    localhost, the applet is accepting an incoming network connection. The
    user is being offered a chance to verify that the applet is the one
    expected. They only have to accept it once, and you can invite them to
    verify your certificate's fingerprint in whatever way makes sense for
    your users. Seeing the warning a second time means the applet may have
    been tampered with locally, which is exactly what the security patch is
    trying to prevent.

    > 3) I've tried passing a command line parameter to the applet in order
    > for it to use an "application" specific policy file, but it seems
    > that an applet can't take the -Djava.security.policy command line
    > parameter.
    > 4) I've read that unsigned applets can (only) open sockets back to
    > the server from which it was loaded, but I'm not using a web server
    > so there is no server URL (and localhost doesn't work).


    --
    John B. Matthews
    trashgod at gmail dot com
    <http://sites.google.com/site/drjohnbmatthews>
    John B. Matthews, Aug 15, 2009
    #2
    1. Advertising

  3. Paul

    Roedy Green Guest

    On Sat, 15 Aug 2009 04:30:30 -0700 (PDT), Paul <>
    wrote, quoted or indirectly quoted someone who said :

    >4) I've read that unsigned applets can (only) open sockets back to the
    >server from which it was loaded, but I'm not using a web server so
    >there is no server URL (and
    > localhost doesn't work).


    to get around that, you must sign your Applet. See
    http://mindprod.com/jgloss/signedapplets.html

    The whole process sounds somewhat convoluted and difficult to
    maintain. A simplifying revamp of the whole approach might be better
    in the long run e.g.

    1. display raw data using an Applet or Java Web Start application.
    2. set up a little local webserver that builds the pages.
    3. port the C++ code to Java

    --
    Roedy Green Canadian Mind Products
    http://mindprod.com

    "If you think it’s expensive to hire a professional to do the job, wait until you hire an amateur."
    ~ Red Adair (born: 1915-06-18 died: 2004-08-07 at age: 89)
    Roedy Green, Aug 15, 2009
    #3
  4. Paul

    markspace Guest

    Roedy Green wrote:

    > 3. port the C++ code to Java
    >


    I was going to suggest the opposite. There must be a C++/VC object that
    displays HTML. I think getting rid of the clunky browser-applet thing
    and just displaying a window directly would simplify things greatly for
    the programmer and the user.
    markspace, Aug 15, 2009
    #4
  5. Paul

    Arne Vajhøj Guest

    markspace wrote:
    > Roedy Green wrote:
    >> 3. port the C++ code to Java

    >
    > I was going to suggest the opposite. There must be a C++/VC object that
    > displays HTML.


    There is.

    But COM programming in C++ is about 100 times more difficult than
    doing stuff in Java.

    Arne
    Arne Vajhøj, Aug 15, 2009
    #5
  6. Paul

    markspace Guest

    Arne Vajhøj wrote:
    > markspace wrote:
    >> Roedy Green wrote:
    >>> 3. port the C++ code to Java

    >>
    >> I was going to suggest the opposite. There must be a C++/VC object
    >> that displays HTML.

    >
    > There is.
    >
    > But COM programming in C++ is about 100 times more difficult than
    > doing stuff in Java.



    I was thinking something that works like a JEditorPane. Not a COM
    object, just an ordinary object that will take a string or buffer full
    of HTML, and does basic rendering on it. I think Windows has a help
    system with such an object, not 100% sure however.
    markspace, Aug 15, 2009
    #6
  7. Hi Paul,

    "Paul" <> wrote in message
    news:...
    8<
    > 4) I've read that unsigned applets can (only) open sockets back to the
    > server from which it was loaded, but I'm not using a web server so
    > there is no server URL (and
    > localhost doesn't work).


    Not knowing what your application is doing, or why, I would suggest the
    server (C++ or whatever) do the listening on whatever port number you like
    and have the Applet connect back to it and request(read) the updates as they
    arrive. If you only have a small number of users and don't want to write a
    multi-threaded server then you might want to investigate using INETd.

    Regards Richard Maher
    Richard Maher, Aug 15, 2009
    #7
  8. Paul

    Paul Guest

    On Aug 15, 6:55 pm, "Richard Maher" <>
    wrote:
    > Hi Paul,
    >
    > "Paul" <> wrote in message
    >
    > news:...
    > 8<
    >
    > > 4) I've read that unsigned applets can (only) open sockets back to the
    > > server from which it was loaded, but I'm not using a web server so
    > > there is no server URL (and
    > >    localhost doesn't work).

    >
    > Not knowing what your application is doing, or why, I would suggest the
    > server (C++ or whatever) do the listening on whatever port number you like
    > and have the Applet connect back to it and request(read) the updates as they
    > arrive. If you only have a small number of users and don't want to write a
    > multi-threaded server then you might want to investigate using INETd.
    >
    > Regards Richard Maher



    But isn't this still the applet opening a socket to localhost? Or does
    it matter whether it is the Applet or the C++ app that is accepting
    the connection?

    Thanks for the help!

    Paul
    Paul, Aug 16, 2009
    #8
  9. Paul

    Arne Vajhøj Guest

    markspace wrote:
    > Arne Vajhøj wrote:
    >> markspace wrote:
    >>> Roedy Green wrote:
    >>>> 3. port the C++ code to Java
    >>>
    >>> I was going to suggest the opposite. There must be a C++/VC object
    >>> that displays HTML.

    >>
    >> There is.
    >>
    >> But COM programming in C++ is about 100 times more difficult than
    >> doing stuff in Java.

    >
    >
    > I was thinking something that works like a JEditorPane. Not a COM
    > object, just an ordinary object that will take a string or buffer full
    > of HTML, and does basic rendering on it. I think Windows has a help
    > system with such an object, not 100% sure however.


    The low level Windows API is C and does not have an object.

    The high level API's in Windows are usually COM based.

    This includes the MSHTML stuff:
    http://msdn.microsoft.com/en-us/library/bb508516.aspx

    Arne
    Arne Vajhøj, Aug 16, 2009
    #9
  10. Paul

    Paul Guest

    On Aug 16, 11:12 am, Paul <> wrote:
    > On Aug 15, 6:55 pm, "Richard Maher" <>
    > wrote:
    >
    >
    >
    > > Hi Paul,

    >
    > > "Paul" <> wrote in message

    >
    > >news:....
    > > 8<

    >
    > > > 4) I've read that unsigned applets can (only) open sockets back to the
    > > > server from which it was loaded, but I'm not using a web server so
    > > > there is no server URL (and
    > > >    localhost doesn't work).

    >
    > > Not knowing what your application is doing, or why, I would suggest the
    > > server (C++ or whatever) do the listening on whatever port number you like
    > > and have the Applet connect back to it and request(read) the updates as they
    > > arrive. If you only have a small number of users and don't want to write a
    > > multi-threaded server then you might want to investigate using INETd.

    >
    > > Regards Richard Maher

    >
    > But isn't this still the applet opening a socket to localhost? Or does
    > it matter whether it is the Applet or the C++ app that is accepting
    > the connection?
    >
    > Thanks for the help!
    >
    > Paul


    Tried it, but you just can't connect to localhost from an unsigned
    applet. Both "connect" and "accept" throw a security exception.

    Paul
    Paul, Aug 16, 2009
    #10
  11. Hi Paul,

    Sorry, I didn't pay enough attention to your File URLS and lack of
    web-server.

    Ok, clutching at straws, do you have FTP running and accepting requests? If
    so set the object/applet/embed tag to use an FTP:// URL to 127.0.0.1 and
    that should be the codebase that the unsigned Applet's Socket can connect
    back to.

    Fingers-crossed!

    Cheers Richard Maher

    "Paul" <> wrote in message
    news:...
    On Aug 16, 11:12 am, Paul <> wrote:
    > On Aug 15, 6:55 pm, "Richard Maher" <>
    > wrote:
    >
    >
    >
    > > Hi Paul,

    >
    > > "Paul" <> wrote in message

    >
    > >news:...
    > > 8<

    >
    > > > 4) I've read that unsigned applets can (only) open sockets back to the
    > > > server from which it was loaded, but I'm not using a web server so
    > > > there is no server URL (and
    > > > localhost doesn't work).

    >
    > > Not knowing what your application is doing, or why, I would suggest the
    > > server (C++ or whatever) do the listening on whatever port number you

    like
    > > and have the Applet connect back to it and request(read) the updates as

    they
    > > arrive. If you only have a small number of users and don't want to write

    a
    > > multi-threaded server then you might want to investigate using INETd.

    >
    > > Regards Richard Maher

    >
    > But isn't this still the applet opening a socket to localhost? Or does
    > it matter whether it is the Applet or the C++ app that is accepting
    > the connection?
    >
    > Thanks for the help!
    >
    > Paul


    Tried it, but you just can't connect to localhost from an unsigned
    applet. Both "connect" and "accept" throw a security exception.

    Paul
    Richard Maher, Aug 17, 2009
    #11
  12. Paul

    Roedy Green Guest

    On Sun, 16 Aug 2009 15:47:31 -0700 (PDT), Paul <>
    wrote, quoted or indirectly quoted someone who said :

    >Tried it, but you just can't connect to localhost from an unsigned
    >applet.


    You can do this:

    <applet class="cmp" archive="converter.jar"
    code="com.mindprod.converter.Converter.class" width="582" height="552"
    alt="You need Java 1.5+ to run this Applet.">
    Sorry, you need Java 1.5+ to run this Applet.
    </applet>

    All you need do is put the jar in the same directory as the HTML page
    that invokes it.

    This will work for a local file or for an Applet served from the web.
    --
    Roedy Green Canadian Mind Products
    http://mindprod.com

    http://thecovemovie.com : The Cove: a documentary about Japan's secret atrocities against dolphins.
    Roedy Green, Aug 19, 2009
    #12
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. TC
    Replies:
    4
    Views:
    644
    JohnnyAppleseed
    Feb 7, 2005
  2. RP
    Replies:
    2
    Views:
    517
    =?ISO-8859-1?Q?Arne_Vajh=F8j?=
    Aug 19, 2007
  3. Alex Bryan

    Connecting a Desktop App to a Web App

    Alex Bryan, Jun 22, 2008, in forum: Python
    Replies:
    0
    Views:
    214
    Alex Bryan
    Jun 22, 2008
  4. Jason Hsu
    Replies:
    2
    Views:
    168
    Miki Tebeka
    Dec 9, 2012
  5. iMath
    Replies:
    7
    Views:
    1,073
    iMath
    Nov 10, 2013
Loading...

Share This Page