From: "Raghunandan Havaldar" <rhavaldar@str.com>
To: <jdk-comments@java.sun.com>, <java-security@java.sun.com>,
Subject: Security problems when loading JDK1.2 Beta 4 classes in browsers
Date: Fri, 21 Aug 1998 12:41:12 -0500
This is a multi-part message in MIME format.
------=_NextPart_000_0080_01BDCD00.FB02CA00
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0081_01BDCD00.FB0BF1C0"
------=_NextPart_001_0081_01BDCD00.FB0BF1C0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hello all,
I have come upon an unexpected problem dealing
with security when loading JDK1.2 beta 4 classes
in the browsers - Communicator and IE. I am using the
Java Plugin for loading the JDK1.2 runtime.
Here's a brief explanation of the problem, and what
is suspect is the reason. I have not been able to solve
it as yet. If any of you have expereinced something
similar or can provide any tips. it would be warmly
welcomed. Thank you.
I have also attached the three related files for inspection.
I am the 'swing' part of the JDK 1.2 beta 4 for GUI. Actually,
just dealing with tree-related classes mainly. The LogBrowserApplet
class is the main applet which renders the GUI. Initially, based
on certain XML data, a tree is generated. Then, depending on
the user's choice, the tree is modified and then displayed.
The problem occurs when loading the applet itself. All the classes
can be loaded and used (inclluding the classes developed by me).
When I try to create an instance of 'TreeConverter' class, I hit the
security-related error (Verify error). I guess this has to do with the
loading of the 'TreeConverter' class. If i skip referencing this class,
I do not have a problem. But, there is nothing obvious about this
security problem.
The details follow:
About to generate a tree viewer ...
java.lang.VerifyError at
com.deluxe.deps.billing.log.browser.LogBrowserApplet.generateTreeViewer(L=
ogB
rowserApplet.java:190)
at
com.deluxe.deps.billing.log.browser.LogBrowserApplet.setDisplay(LogBrowse=
rAp
plet.java:128)
at
com.deluxe.deps.billing.log.browser.LogBrowserApplet.init(LogBrowserApple=
t.j
ava:36)
at
com.deluxe.deps.billing.log.browser.LogBrowserApplet.<init>(LogBrowserApp=
let
.java:31)
at sun.applet.AppletPanel.createApplet(AppletPanel.java:462)
at sun.applet.AppletPanel.runLoader(AppletPanel.java:398)
at sun.applet.AppletPanel.run(Compiled Code)
at java.lang.Thread.run(Thread.java)
The TreeConverter class is a simple class which a set of
java.util.* classes to store and sort objects. Some of us
feel that the exception might be due to the way the 'util' classes
are implemented. The java.util.Vector could be the reason.
There seems to be no another 'direct' reason why we encounter this
problem. I have also attached the files defining Node class and
TreeConverter class for reference and inspection.
I can get back with more explanation if desired.
Thanks
Raghu.
rhavaldar@str.com
------=_NextPart_001_0081_01BDCD00.FB0BF1C0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">
Node
class represents a node of
* tree. It contains node-related information. They are
* name & value (stored in n object of =20
* NodeInformation
class), pointer to 'parent' node,
* and a list of its children.
*
* It implements the com.sun.java.swing.tree.MutableTreeNode
*
interface. This enables usage of objects of
* Node
class to be used in a com.sun.java.swing.JTree=20
*
object for tree generation and rendering.
*
* It also consists of utility methods for 'cloning' a node.
*
* @author Raghu Havaldar - STR
* @see com.sun.java.swing.JTree
* @see com.sun.java.swing.tree.TreeNode
* @see com.sun.java.swing.tree.MutableTreeNode
* @see java.util.Vector
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @since JDK 1.2 Beta 4
*/
public class Node=20
implements com.sun.java.swing.tree.MutableTreeNode {
/**
* This constructor sets default values for its members.
* The value of its parent is not set.
*
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @see java.util.Vector
* @since JDK 1.2 Beta 4
*/=09
public Node () {
this.NodeInfo =3D new NodeInformation () ;
this.Children =3D new Vector () ;
}
/**
* This constructor sets values for its members including the
* value of its parent.
*
* @param nodeInfo information regarding the node - name and value
* @param parent the parent of this node
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @see java.util.Vector
* @since JDK 1.2 Beta 4
*/=09
public Node (NodeInformation nodeInfo,
TreeNode parent) {
this () ;
this.NodeInfo =3D nodeInfo ;
this.ParentNode =3D (Node)parent ;
}
// set methods
/**
* sets the name of the node
*
* @param name name of the node
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @since JDK 1.2 Beta 4
*/=09
public void setName (String name) {
(this.NodeInfo).setName (name) ;
}
/**
* sets the value of the node
*
* @param value value of the node
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @since JDK 1.2 Beta 4
*/=09
public void setValue (String value) {
(this.NodeInfo).setValue (value) ;
}
/**
* sets the parent of the node
*
* @param parentNode parent of the node
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @since JDK 1.2 Beta 4
*/=09
public void setParentNode (TreeNode parentNode) {
this.ParentNode =3D (Node)parentNode ;
}
/**
* adds a child to the node
*
* @param child node which would be added as a child
* @since JDK 1.2 Beta 4
*/=09
public void addChildNode (TreeNode child) {
(this.Children).addElement (child) ;
}
/**
* sets the children of the node
*
* @param children the new children of the node
* @see java.util.Vector
* @since JDK 1.2 Beta 4
*/ =09
public void setChildren (Vector children) {
this.Children =3D children ;
}
// accessor methods
/**
* get the name of the node
*
* @return the name of the node
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @since JDK 1.2 Beta 4
*/=09
public String getName () {
return ((this.NodeInfo).getName ()) ;
}
/**
* get the value of the node
*
* @return the value of the node
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @since JDK 1.2 Beta 4
*/=09
public String getValue () {
return ((this.NodeInfo).getValue()) ;
}
/**
* get the parent of the node
*
* @return the parent node
* @since JDK 1.2 Beta 4
*/=09
public Node getParentNode () {
return (this.ParentNode) ;
}
/**
* get all the children of the node
*
* @return the children of the node
* @since JDK 1.2 Beta 4
*/ =09
public Vector getChildren () {
return (this.Children) ;
}
/**
* get the number of children of the node
*
* @return the number of children of the node
* @since JDK 1.2 Beta 4
*/ =09
public int getChildrenSize () {
return ((this.getChildren ()).size ()) ;
}
// utility methods
/**
* checks if the a child exists with the identified 'name'
*
* @param name of the 'expected' child
* @return
* This conversion is custom-specific and as per the
* requirements. It could however be modified easily as=20
* the requirements change.
*
* @author Raghu Havaldar - STR
* @see java.io.InputStream
* @see java.util.List
* @see java.util.Collections
* @see java.util.Vector
* @see java.util.Comparator
* @see com.deluxe.deps.billing.log.browser.Node
* @see com.deluxe.deps.billing.log.browser.DateComparator
* @see com.deluxe.deps.billing.log.browser.StringComparator
* @see com.deluxe.deps.billing.log.browser.TimeComparator
* @since JDK 1.2 Beta 4
*/
public class TreeConverter {
/**
* A constructor which accepts the
true
if a child exists with the name,=20
* false
if not.
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @since JDK 1.2 Beta 4
*/=09
public boolean isChild (String name) {
boolean flag =3D false ;
=09
for (int i=3D0; i this
node.
*
* @return the node with the specified name
* @since JDK 1.2 Beta 4
*/
public Node cloneNode () { =09
Node nodeCopy =3D new Node () ;=20
this.generateCopy (this, nodeCopy) ;
return (nodeCopy) ;=09
}
// methods specific to the com.sun.java.swing.TreeNode interface
=09
/**
* returns the children of the node as an Enumeration
*
* @return the children of the node
* @since JDK 1.2 Beta 4
*/=20
public Enumeration children () {
return ((this.getChildren ()).elements ()) ;
}
/**
* returns true if the node allows children.
*
* @return true
if the node allows
* children, false
otherwise.
* @since JDK 1.2 Beta 4
*/
public boolean getAllowsChildren() {
return (true) ; // default mechanism
}
// Returns the child TreeNode at index childIndex.=20
/**
* get the child node at a particular index
*
* @param childName name of the child
* @return the node with the specified name
* @see com.deluxe.deps.billing.log.browser.NodeInformation
* @since JDK 1.2 Beta 4
*/ =20
public TreeNode getChildAt (int childIndex) {
Vector children =3D this.getChildren () ;
return ((TreeNode)children.elementAt (childIndex)) ; =20
}
/**
* returns the number of children the node contains.
*
* @return the number of children
* @since JDK 1.2 Beta 4
*/
public int getChildCount () {
return ((this.getChildren ()).size ()) ;
}
=20
/**
* returns the index of child node in the node's children
*
* @return the index of the child node
* @since JDK 1.2 Beta 4
*/
public int getIndex (TreeNode node) {
int index =3D -1 ;
=09
if ((this.getChildren ()).contains (node))
index =3D (this.getChildren ()).indexOf (node) ;
return (index) ;
}
=20
/**
* returns the parent of the node.
*
* @return the parent of the node
* @since JDK 1.2 Beta 4
*/
public TreeNode getParent () {
return ((TreeNode)this.getParentNode ()) ;
}
/**
* checks if the node is a leaf.=20
*
* @return true
if it is a leaf,=20
* false
otherwise.
* @since JDK 1.2 Beta 4
*/ =20
public boolean isLeaf () {
boolean flag =3D false ;
if ((this.getChildren () =3D=3D null) ||
((this.getChildren ()).isEmpty ()))
flag =3D true ;
return (flag) ;
}
=20
/* methods specific to the com.sun.java.swing.tree.MutableTreeNode
* interface
*/=20
/**
* adds child to the receiver at index.
*
* @param child the node to be added as child
* @param index the position where the node has to be added
* @since JDK 1.2 Beta 4
*/
public void insert (MutableTreeNode child, int index) {
(this.getChildren ()).insertElementAt (child, index) ;
}
=20
/**
* removes the child at index from the receiver.
*
* @param index the position from which a=20
* child node has to be removed
* @since JDK 1.2 Beta 4
*/
public void remove (int index) {
(this.getChildren ()).remove (index) ;
}
=20
/**
* removes the specified child from the node
*
* @param node the specified child node
* @since JDK 1.2 Beta 4
*/
public void remove (MutableTreeNode node) {
(this.getChildren ()).remove (node) ;
}
=20
/**
* removes the node from its parent. Implictly=20
* removes the pointer to its parent node.
*
* @since JDK 1.2 Beta 4
*/
public void removeFromParent () {
this.setParentNode (null) ;
}
=20
/**
* sets the new parent of the node
*
* @param newParent the new parent
* @since JDK 1.2 Beta 4
*/
public void setParent(MutableTreeNode newParent) {
this.setParentNode (newParent) ;
}
=20
/**
* resets the user object of the node. This user object
* represents an object which can be associated with a node
* a tree (for application-specific purposes).
*
* @param object the user object to be associated with the node
* @since JDK 1.2 Beta 4
*/
public void setUserObject (Object object) {
this.NodeInfo =3D (NodeInformation)object ;
}
// private members
private NodeInformation NodeInfo =3D null ;
private Node ParentNode =3D null ;
private Vector Children =3D null ;
private void generateCopy (Node referenceNode, Node copyNode) {
if (referenceNode.getParentNode () =3D=3D null) {
// generating the root
String copyRootName =3D new String (referenceNode.getName ()) ;
copyNode.setName (copyRootName) ;
String copyRootValue =3D new String (referenceNode.getValue ()) ;=09
copyNode.setValue (copyRootValue) ;=09
// no parent for root =09
copyNode.setParentNode (referenceNode.getParentNode ()) ; =09
}// end if
=09
Vector referenceNodeChildren =3D referenceNode.getChildren () ;
for (int i=3D0; i =
com.deluxe.deps.billing.log.browser.Node=20
*
as an argument. This node represents the root node of the =
tree which needs
* to be converted from one form to another based on a 'view'.
*
* @param rootNode the node which represents the root of the original =
tree.
* @see com.deluxe.deps.billing.log.browser.Node
* @since JDK 1.2 Beta 4
*/
public TreeConverter (Node rootNode) {
this.RootNode =3D rootNode ;
}
/**
* It converts the tree from one form to another based on the =
'view'.
* This view is specified as the input.
*
* @param criteriaElement represents the view critieria.
* @see java.util.List
* @see java.util.Collections
* @see java.util.Vector
* @see com.deluxe.deps.billing.log.browser.Node
* @see com.deluxe.deps.billing.log.browser.DateComparator
* @see com.deluxe.deps.billing.log.browser.StringComparator
* @see com.deluxe.deps.billing.log.browser.TimeComparator
* @since JDK 1.2 Beta 4
*/
public void convert (String criteriaElement) {
// the node to handle 'unknown' or non-parseable entries
Node unknownNode =3D new Node () ;
unknownNode.setName ("Unknown List") ;
unknownNode.setValue ("") ;
=20
// Stage 1
// get the children of the 'root' node
Vector children =3D (this.getRootNode ()).getChildren () ;
// make a copy of the children nodes
Vector childrenCopy =3D (Vector)children.clone () ;
// and, remove them from the 'root' node
(this.getRootNode ()).removeAllChildren () ;
for (int i=3D0; i