带有 LWJGL 的 JavaApplet 在更新到 7u45 后损坏

Question

我们有一个 Java Apllet，运行几年没有问题。它使用 LWJGL，所有 jar 都使用适当的证书签名(不是自签名)。在最后一次 Java 更新到 u45 之后，小程序崩溃了。

到目前为止我们做了什么:

• 添加权限:对所有 JAR list 的所有权限
• 将 pplication-Library-Allowable-Codebase: * 添加到所有 JAR 的 list
• 将 Caller-Allowable-Codebase: * 添加到所有 JAR 的 list
• 添加代码库:* 到所有 JAR 的 list
• 上述的不同排列

我知道安全警告的配置方式发生了一些变化，但是(现在!)我们不关心请求权限的弹出窗口。首先我们想让它工作，

这里是 java 控制台中发生的所有异常。其余的输出似乎没问题:

java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at org.lwjgl.util.applet.AppletLoader$4.getPermissions(AppletLoader.java:1206)
    at java.security.SecureClassLoader.getProtectionDomain(Unknown Source)
    at java.security.SecureClassLoader.defineClass(Unknown Source)
    at java.net.URLClassLoader.defineClass(Unknown Source)
    at java.net.URLClassLoader.access$100(Unknown Source)
    at java.net.URLClassLoader$1.run(Unknown Source)
    at java.net.URLClassLoader$1.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.findClass(Unknown Source)
    at java.lang.ClassLoader.loadClass(Unknown Source)
    at java.lang.ClassLoader.loadClass(Unknown Source)
    at org.lwjgl.util.applet.AppletLoader.switchApplet(AppletLoader.java:1319)
    at org.lwjgl.util.applet.AppletLoader$2.run(AppletLoader.java:909)
    at java.awt.event.InvocationEvent.dispatch(Unknown Source)
    at java.awt.EventQueue.dispatchEventImpl(Unknown Source)
    at java.awt.EventQueue.access$200(Unknown Source)
    at java.awt.EventQueue$3.run(Unknown Source)
    at java.awt.EventQueue$3.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.security.ProtectionDomain$1.doIntersectionPrivilege(Unknown Source)
    at java.awt.EventQueue.dispatchEvent(Unknown Source)
    at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
    at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
    at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
    at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
    at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
    at java.awt.EventDispatchThread.run(Unknown Source)
Caused by: java.lang.NullPointerException
    at sun.plugin2.applet.Plugin2ClassLoader.loadAllowedCodebases(Unknown Source)
    at sun.plugin2.applet.Plugin2ClassLoader.getPermissions(Unknown Source)
    at sun.plugin2.applet.Applet2ClassLoader.getPermissions(Unknown Source)
    ... 31 more

和:

java.lang.reflect.InvocationTargetException
    at java.awt.EventQueue.invokeAndWait(Unknown Source)
    at java.awt.EventQueue.invokeAndWait(Unknown Source)
    at org.lwjgl.util.applet.AppletLoader.run(AppletLoader.java:906)
    at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.ExceptionInInitializerError
    at org.lwjgl.Sys.createImplementation(Sys.java:124)
    at org.lwjgl.Sys.<clinit>(Sys.java:111)
    at org.lwjgl.opengl.AWTGLCanvas.<clinit>(AWTGLCanvas.java:87)
    at j2cad.d.c.k(Unknown Source)
    at j2cad.applet.J2CadApplet.init(Unknown Source)
    at org.lwjgl.util.applet.AppletLoader.switchApplet(AppletLoader.java:1330)
    at org.lwjgl.util.applet.AppletLoader$2.run(AppletLoader.java:909)
    at java.awt.event.InvocationEvent.dispatch(Unknown Source)
    at java.awt.EventQueue.dispatchEventImpl(Unknown Source)
    at java.awt.EventQueue.access$200(Unknown Source)
    at java.awt.EventQueue$3.run(Unknown Source)
    at java.awt.EventQueue$3.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.security.ProtectionDomain$1.doIntersectionPrivilege(Unknown Source)
    at java.awt.EventQueue.dispatchEvent(Unknown Source)
    at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
    at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
    at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
    at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
    at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
    at java.awt.EventDispatchThread.run(Unknown Source)
Caused by: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "org.lwjgl.util.Debug" "read")
    at java.security.AccessControlContext.checkPermission(Unknown Source)
    at java.security.AccessController.checkPermission(Unknown Source)
    at java.lang.SecurityManager.checkPermission(Unknown Source)
    at sun.plugin2.applet.AWTAppletSecurityManager.checkPermission(Unknown Source)
    at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
    at java.lang.System.getProperty(Unknown Source)
    at java.lang.Boolean.getBoolean(Unknown Source)
    at org.lwjgl.LWJGLUtil$4.run(LWJGLUtil.java:454)
    at org.lwjgl.LWJGLUtil$4.run(LWJGLUtil.java:452)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.lwjgl.LWJGLUtil.getPrivilegedBoolean(LWJGLUtil.java:452)
    at org.lwjgl.LWJGLUtil.<clinit>(LWJGLUtil.java:265)
    ... 21 more

第一个出现多次，第二个在日志末尾只出现一次。

感谢所有建议，网站已为所有进行更新的人关闭!

谢谢大家!

Answer 1

我发现了一个令人毛骨悚然的解决方法来避免这个问题，因为 lwjgl_util_applet.jar 中的 AppletLoader 通过替换默认的类加载器来覆盖安全上下文。所以我们需要修补它:

1 - 下载类(class) HERE

2 - 替换这个:

classLoader = new URLClassLoader(urls) {

用这个:

classLoader = new URLClassLoader(urls, Thread.currentThread().getContextClassLoader()) {

这个:

Thread.currentThread().setContextClassLoader(classLoader);
Class appletClass = classLoader.loadClass(getParameter("al_main"));

用这个:

Class appletClass = Thread.currentThread().getContextClassLoader().loadClass(getParameter("al_main"));

还有这个:

urlconnection.setDefaultUseCaches(false);

用这个:

urlconnection.setDefaultUseCaches(true);

3 - 用新的编译并覆盖 lwjgl_util_applet.jar 的 .class。

4 - 删除所有 jar 的签名(如果存在)并使用 MANIFEST.MF 中的这些属性重新签名

Manifest-Version: 1.0
Trusted-Library: true
Application-Library-Allowable-Codebase: *
Trusted-Only: false
Application-Name: My app
Permissions: all-permissions
Created-By: 1.6.0_16 (Sun Microsystems Inc.)
Caller-Allowable-Codebase: *
Codebase: *

5 - 在小程序标签中，放入:

<param name="permissions" value="all-permissions">
<param name="codebase_lookup" value="true">
<param name="classloader_cache" value="false">
<param name="al_version" value="0.1">"

6 -(令人毛骨悚然的部分)将所有 jar 放入参数“archive”中的参数“al_jars”中(只需在 al_jars 中放置一个空格)，

7 - 清理您的缓存(java 和浏览器)并将您的 java 缓存设置为 Activity 状态(就像您应用的 future 用户一样)，

8 - 运行您的小程序，祝您好运。