Signed Java applet with correct manifest cannot write to home directory

[Thomas Richter]

Hi folks,

here is a question on signed applets: We do have here a learning
application that should allow students to save their results to their
local desktop. This application is currently realized as a java
application and runs from the browser.

The applet is signed, and it is *not* a self-certificate, but an
official certificate by the university, which is again certified by the
DFN, which is again certified by the Deutsche Telekom. IOW, the
certification chain is correct.

The applet also has a proper manifest file that defines the codebase,
the application library allowable codebase etc:

Main-Class: XXXXXXXXXXXXXX
Permissions: all-permissions
Codebase: XXXXXXXXXXXXXXXXXXX
Application-Library-Allowable-Codebase: XXXXXXXXXXXXXXXXxx
Application-Name: XXXXXXXXXXXXXXX
Trusted-Only: true
Trusted-Library: true

When I run this applet from firefox, windows or linux, everything is
fine. The user gets a warning that the applet will or might write to
local files, though the warning states that the certificate is correct,
and states its origin correctly. All fine.

However, if I run the same applet from Safari, I *also* get the warning,
the applet runs, but saving solutions requiring write access to the
local home directory does *not* work. The system creates a "permission
denied" error. I do not get any warning or error messages on the java
console, and all I see when starting the applet is the typical warning
that this is an applet requiring full access to the desktop.

Strangely enough, if I run the same applet from firefox, on the same
machine (an Apple under MacOs), everything works perfectly.

Any ideas what might be missing to get this working?

Greetings,
Thomas

 

[Robert Klemme]

When I run this applet from firefox, windows or linux, everything is
fine. The user gets a warning that the applet will or might write to
local files, though the warning states that the certificate is correct,
and states its origin correctly. All fine.

However, if I run the same applet from Safari, I *also* get the warning,
the applet runs, but saving solutions requiring write access to the
local home directory does *not* work. The system creates a "permission
denied" error. I do not get any warning or error messages on the java
console, and all I see when starting the applet is the typical warning
that this is an applet requiring full access to the desktop.

Strangely enough, if I run the same applet from firefox, on the same
machine (an Apple under MacOs), everything works perfectly.

Any ideas what might be missing to get this working?

Just today a colleague told me something similar. The solution was that
there needed to be done some additional settings to the sandboxing of
either Java or Safari to allow the JRE to break out of the sandbox.
Since I am not a Mac user I don't have more details but maybe that gets
you started looking in the right places.

Kind regards

robert