Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SecurityException when running App in Java Web Start sandbox #4734

Closed
scabug opened this issue Jun 24, 2011 · 5 comments
Closed

SecurityException when running App in Java Web Start sandbox #4734

scabug opened this issue Jun 24, 2011 · 5 comments

Comments

@scabug
Copy link

scabug commented Jun 24, 2011

I recently rewrote one of my Scala applications to use App, and it worked great in my development environment. However, when we deployed it under Web Start, it crashed with a Java Web Start Error: access denied (java.util.PropertyPermission scala.time read). Here is the top of the stack trace:

java.security.AccessControlException: access denied
(java.util.PropertyPermission scala.time read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
at java.lang.System.getProperty(Unknown Source)
at scala.util.PropertiesTrait$class.propIsSet(Properties.scala:44)
at scala.App$class.main(App.scala:61)
at
edu.colorado.phet.motionseries.sims.rampforcesandmotion.RampForcesAndMotionApplication
$.main(RampForcesAndMotionApplication.scala:123)
........

The Java Web Start console prints this:

Java Web Start Error:
access denied (java.util.PropertyPermission scala.time read)

The source code for App.scala on lampsvn here:
http://lampsvn.epfl.ch/svn-repos/scala/scala/trunk/src/library/scala/App.scala

shows that main is implemented like this:

def main(args: Array[String]) = {
this._args = args
for (proc <- initCode) proc()
if (util.Properties.propIsSet("scala.time")) {
val total = currentTime - executionStart
Console.println("[total " + total + "ms]")
}
}

Can App.main be rewritten to check for permission to read this system property, or alternatively try/catching the AccessControlException (or maybe there is a better Scala way for handling this issue)? Without a fix for this, I don't think we will be able to use App for any of our production Scala applications since they run in the Java Web Start sandbox. I haven't tested it, but maybe the former solution would look something like this:

def main(args: Array[String]) = {
this._args = args
for ( proc <- initCode ) {
proc()
}

/If we have the permission to check the "scala.time" property, do so and print the time the application took to start up.
Permission checks are necessary because Java Web Start's SecurityManager (and possibly others) will not grant permission
to read the "scala.time" property.
/
val scalaTimePropertyKey = "scala.time"
val permissionToRead = if ( System.getSecurityManager != null ) {
try {
System.getSecurityManager.checkPermission(new PropertyPermission(scalaTimePropertyKey, "read"))
true
}
catch {
case _ => false
}
}
if ( permissionToRead && util.Properties.propIsSet(scalaTimePropertyKey) ) {
val total = currentTime - executionStart
Console.println("[total " + total + "ms]")
}
}

This issue looks related to recently closed issues:
#3632 scala.util.properties.versionString doesn't work in applets
#94: Security exception upon Actors library initialization.

Please let me know if you need any additional information.

Thanks!
Sam

@scabug
Copy link
Author

scabug commented Jun 24, 2011

Imported From: https://issues.scala-lang.org/browse/SI-4734?orig=1
Reporter: Sam Reid (samreid)
Affected Versions: 2.9.0, 2.9.1
See #4677

@scabug
Copy link
Author

scabug commented Jun 24, 2011

@paulp said:
We don't have the resources to play whack-a-mole and solving the general issue requires improved infrastructure for abstracting over different operating environments. It's desirable, no question. I'm closing related issue #3519 and pointing it here.

@scabug
Copy link
Author

scabug commented Dec 10, 2012

@retronym said:
Relates to #4677

@magnolia-k
Copy link

Since Java Web Start has been removed from Java11, should this issue be closed anymore?

@SethTisue SethTisue removed this from the Backlog milestone Aug 9, 2019
@SethTisue
Copy link
Member

in theory I suppose someone might want App changed in this way for some other security-manager related context besides Java Web Start itself.

closing unless someone appears who is interested and wants it reopened.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants