java - Java 8 中的新 java.security.AccessControlException

Question

以前工作的网络代码抛出 java.security.AccessControlException在完全沙盒化的 Java applet 中。

Can't get socket 2255: java.security.AccessControlException: access denied ("java.net.SocketPermission" "50.31.1.13:2255" "connect,resolve")

甲骨文改变了什么——必须跳到什么新的安全圈保持套接字正常工作？

这适用于 Java 1.7.0_55 和所有以前的 java 版本。

Answer 1

这确实改变了......来自文档

http://docs.oracle.com/javase/8/docs/technotes/guides/jweb/enhancements-8.html

• For sandbox RIAs, URLPermission is now used to allow connections back to the server from which they were started. URLPermissions is granted based on protocol, host and port of the code source. This change has the following implications:

  • For sandbox RIAs, SocketPermissions for the origin host is no longer granted. Calls from JavaScript code to the RIA are not granted SocketPermissions beginning with JDK 8.

  …

换句话说，您不能再在沙箱中创建新的Socket。您只能使用相同的主机、相同的端口和相同的协议(protocol)创建一个URL，作为来自完全沙盒小程序的代码库。 p>

除非 Oracle 改变主意，否则沙盒小程序无法解决这个问题(否则它会破坏整个安全概念)。