JRuby (please use github issues at http://bugs.jruby.org)
  1. JRuby (please use github issues at http://bugs.jruby.org)
  2. JRUBY-6110

Security issue with org.jruby.embed.class.path in unsigned JavaFX applet.

    Details

    • Number of attachments :
      1

      Description

      Hi,

      I have security issues when using embeded Ruby in a unsigned JavaFX Applet.
      I encountered this already in swing but I was able to workaround it by signing the applet, javaFx breaks somehow when I try to sign it.
      Sorry for my ignorance if this is a double post and/or can't be resolved.

      Heres some Codes for the JavaFx Application:

      /*
       * To change this template, choose Tools | Templates and open the template in
       * the editor.
       */
      package javafxapplication2;
      
      import javafx.application.Application;
      import javafx.event.ActionEvent;
      import javafx.event.EventHandler;
      import javafx.scene.Group;
      import javafx.scene.Scene;
      import javafx.scene.control.Button;
      import javafx.stage.Stage;
      import javax.swing.JPanel;
      import org.jruby.embed.LocalContextScope;
      import org.jruby.embed.ScriptingContainer;
      
      /**
       *
       * @author Administrator
       */
      public class JavaFXApplication2 extends Application {
      
          /**
           * @param args the command line arguments
           */
          private ScriptingContainer c;
          public static void main(String[] args) {
              Application.launch(args);
          }
         
          @Override
          public void start(Stage primaryStage) {
              primaryStage.setTitle("Hello World");
              Group root = new Group();
              Scene scene = new Scene(root, 300, 250);
              Button btn = new Button();
             
              btn.setLayoutX(100);
              btn.setLayoutY(80);
              btn.setText("Hello World");
              JPanel panel = new JPanel();
              btn.setOnAction(new EventHandler<ActionEvent>() {
             
                  public void handle(ActionEvent event) {
                      System.out.println("Hello World");
                       c = new ScriptingContainer(LocalContextScope.THREADSAFE);
                       c.runScriptlet("puts 'wooopwoop'");
                  }
              });
              root.getChildren().add(btn);       
              primaryStage.setScene(scene);       
              primaryStage.show();
          }
      }
      

      An here the errors:

      Java-Plug-in 10.0.1.255
      JRE-Version verwenden 1.7.0-b147 Java HotSpot(TM) Client VM
      
      Got ConfigEvent[type=SetVisible, value=true]
      
      Got DownloadEvent[type=verify,loaded=1, total=1, percent=100]
      
      Got AppletInitEvent[type=CallConstructor]
      
      Got AppletInitEvent[type=CallInit]
      
      Got AppletInitEvent[type=CallStart]
      
      Hello World
      
      java.security.AccessControlException: access denied ("java.util.PropertyPermission" "org.jruby.embed.class.path" "read")
          at java.security.AccessControlContext.checkPermission(Unknown Source)
          at java.security.AccessController.checkPermission(Unknown Source)
          at java.lang.SecurityManager.checkPermission(Unknown Source)
          at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
          at java.lang.System.getProperty(Unknown Source)
          at org.jruby.embed.util.SystemPropertyCatcher.findLoadPaths(SystemPropertyCatcher.java:242)
          at org.jruby.embed.ScriptingContainer.initConfig(ScriptingContainer.java:249)
          at org.jruby.embed.ScriptingContainer.<init>(ScriptingContainer.java:223)
          at org.jruby.embed.ScriptingContainer.<init>(ScriptingContainer.java:187)
          at javafxapplication2.JavaFXApplication2$1.handle(JavaFXApplication2.java:47)
          at javafxapplication2.JavaFXApplication2$1.handle(JavaFXApplication2.java:43)
          at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventUtil.fireEventImpl(Unknown Source)
          at com.sun.javafx.event.EventUtil.fireEvent(Unknown Source)
          at javafx.event.Event.fireEvent(Unknown Source)
          at javafx.scene.Node.fireEvent(Unknown Source)
          at javafx.scene.control.Button.fire(Unknown Source)
          at com.sun.javafx.scene.control.behavior.ButtonBehavior.mouseReleased(Unknown Source)
          at com.sun.javafx.scene.control.skin.SkinBase$4.handle(Unknown Source)
          at com.sun.javafx.scene.control.skin.SkinBase$4.handle(Unknown Source)
          at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventUtil.fireEventImpl(Unknown Source)
          at com.sun.javafx.event.EventUtil.fireEvent(Unknown Source)
          at javafx.event.Event.fireEvent(Unknown Source)
          at javafx.scene.Scene$MouseHandler.process(Unknown Source)
          at javafx.scene.Scene$MouseHandler.process(Unknown Source)
          at javafx.scene.Scene$MouseHandler.access$1200(Unknown Source)
          at javafx.scene.Scene.impl_processMouseEvent(Unknown Source)
          at javafx.scene.Scene$ScenePeerListener.mouseEvent(Unknown Source)
          at com.sun.javafx.tk.quantum.GlassViewEventHandler.handleMouseEvent(Unknown Source)
          at com.sun.glass.ui.View.handleMouseEvent(Unknown Source)
          at com.sun.glass.ui.View.notifyMouse(Unknown Source)
          at com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
          at com.sun.glass.ui.win.WinApplication.access$100(Unknown Source)
          at com.sun.glass.ui.win.WinApplication$2$1.run(Unknown Source)
          at java.lang.Thread.run(Unknown Source)
      java.lang.RuntimeException: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "org.jruby.embed.class.path" "read")
          at org.jruby.embed.ScriptingContainer.<init>(ScriptingContainer.java:227)
          at org.jruby.embed.ScriptingContainer.<init>(ScriptingContainer.java:187)
          at javafxapplication2.JavaFXApplication2$1.handle(JavaFXApplication2.java:47)
          at javafxapplication2.JavaFXApplication2$1.handle(JavaFXApplication2.java:43)
          at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventUtil.fireEventImpl(Unknown Source)
          at com.sun.javafx.event.EventUtil.fireEvent(Unknown Source)
          at javafx.event.Event.fireEvent(Unknown Source)
          at javafx.scene.Node.fireEvent(Unknown Source)
          at javafx.scene.control.Button.fire(Unknown Source)
          at com.sun.javafx.scene.control.behavior.ButtonBehavior.mouseReleased(Unknown Source)
          at com.sun.javafx.scene.control.skin.SkinBase$4.handle(Unknown Source)
          at com.sun.javafx.scene.control.skin.SkinBase$4.handle(Unknown Source)
          at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
          at com.sun.javafx.event.EventUtil.fireEventImpl(Unknown Source)
          at com.sun.javafx.event.EventUtil.fireEvent(Unknown Source)
          at javafx.event.Event.fireEvent(Unknown Source)
          at javafx.scene.Scene$MouseHandler.process(Unknown Source)
          at javafx.scene.Scene$MouseHandler.process(Unknown Source)
          at javafx.scene.Scene$MouseHandler.access$1200(Unknown Source)
          at javafx.scene.Scene.impl_processMouseEvent(Unknown Source)
          at javafx.scene.Scene$ScenePeerListener.mouseEvent(Unknown Source)
          at com.sun.javafx.tk.quantum.GlassViewEventHandler.handleMouseEvent(Unknown Source)
          at com.sun.glass.ui.View.handleMouseEvent(Unknown Source)
          at com.sun.glass.ui.View.notifyMouse(Unknown Source)
          at com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
          at com.sun.glass.ui.win.WinApplication.access$100(Unknown Source)
          at com.sun.glass.ui.win.WinApplication$2$1.run(Unknown Source)
          at java.lang.Thread.run(Unknown Source)
      Caused by: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "org.jruby.embed.class.path" "read")
          at java.security.AccessControlContext.checkPermission(Unknown Source)
          at java.security.AccessController.checkPermission(Unknown Source)
          at java.lang.SecurityManager.checkPermission(Unknown Source)
          at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
          at java.lang.System.getProperty(Unknown Source)
          at org.jruby.embed.util.SystemPropertyCatcher.findLoadPaths(SystemPropertyCatcher.java:242)
          at org.jruby.embed.ScriptingContainer.initConfig(ScriptingContainer.java:249)
          at org.jruby.embed.ScriptingContainer.<init>(ScriptingContainer.java:223)
          ... 44 more
      

      Thanks a lot in advance for your effort !

        Activity

        Hide
        Yoko Harada added a comment -

        I fixed OSEnvironment class' System.geProperty to check permission.

        The revision is 5737ac6 on master and 69c2b7b on jruby-1_6 branches.

        I'm hoping this fixes the bug completely.

        Show
        Yoko Harada added a comment - I fixed OSEnvironment class' System.geProperty to check permission. The revision is 5737ac6 on master and 69c2b7b on jruby-1_6 branches. I'm hoping this fixes the bug completely.
        Hide
        Hiro Asari added a comment -

        Confirmed that the example app works on master and the 1.6 branch. Screenshot is attached.

        Show
        Hiro Asari added a comment - Confirmed that the example app works on master and the 1.6 branch. Screenshot is attached.
        Hide
        peter added a comment - - edited

        Thanks guys..I finally had the time to try it again.. and it works !!!!! me gusta

        Show
        peter added a comment - - edited Thanks guys..I finally had the time to try it again.. and it works !!!!! me gusta
        Hide
        peter added a comment - - edited

        oh no..I get this error now when I try to run from browser:

        Hello World!
        java.lang.NullPointerException
        at org.jruby.util.OSEnvironment.addRubyKeyValuePair(OSEnvironment.java:101)
        at org.jruby.util.OSEnvironment.getAsMapOfRubyStrings(OSEnvironment.java:85)
        at org.jruby.util.OSEnvironment.getEnvironmentVariableMap(OSEnvironment.java:51)
        at org.jruby.RubyGlobal.defineGlobalEnvConstants(RubyGlobal.java:411)
        at org.jruby.RubyGlobal.createGlobals(RubyGlobal.java:363)
        at org.jruby.Ruby.init(Ruby.java:1094)
        at org.jruby.Ruby.newInstance(Ruby.java:184)
        at org.jruby.embed.internal.LocalContext.getThreadSafeRuntime(LocalContext.java:69)
        at org.jruby.embed.internal.ThreadSafeLocalContextProvider.getRuntime(ThreadSafeLocalContextProvider.java:61)
        at org.jruby.embed.internal.EmbedRubyRuntimeAdapterImpl.runParser(EmbedRubyRuntimeAdapterImpl.java:166)
        at org.jruby.embed.internal.EmbedRubyRuntimeAdapterImpl.parse(EmbedRubyRuntimeAdapterImpl.java:93)
        at org.jruby.embed.ScriptingContainer.parse(ScriptingContainer.java:1195)
        at org.jruby.embed.ScriptingContainer.runScriptlet(ScriptingContainer.java:1255)
        at javafxapplication1.JavaFXApplication1$1.handle(JavaFXApplication1.java:43)
        at javafxapplication1.JavaFXApplication1$1.handle(JavaFXApplication1.java:37)
        at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(Unknown Source)
        at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
        at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
        at com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(Unknown Source)
        at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.EventUtil.fireEventImpl(Unknown Source)
        at com.sun.javafx.event.EventUtil.fireEvent(Unknown Source)
        at javafx.event.Event.fireEvent(Unknown Source)
        at javafx.scene.Node.fireEvent(Unknown Source)
        at javafx.scene.control.Button.fire(Unknown Source)
        at com.sun.javafx.scene.control.behavior.ButtonBehavior.mouseReleased(Unknown Source)
        at com.sun.javafx.scene.control.skin.SkinBase$5.handle(Unknown Source)
        at com.sun.javafx.scene.control.skin.SkinBase$5.handle(Unknown Source)
        at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(Unknown Source)
        at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
        at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source)
        at com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(Unknown Source)
        at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source)
        at com.sun.javafx.event.EventUtil.fireEventImpl(Unknown Source)
        at com.sun.javafx.event.EventUtil.fireEvent(Unknown Source)
        at javafx.event.Event.fireEvent(Unknown Source)
        at javafx.scene.Scene$MouseHandler.process(Unknown Source)
        at javafx.scene.Scene$MouseHandler.process(Unknown Source)
        at javafx.scene.Scene$MouseHandler.access$1300(Unknown Source)
        at javafx.scene.Scene.impl_processMouseEvent(Unknown Source)
        at javafx.scene.Scene$ScenePeerListener.mouseEvent(Unknown Source)
        at com.sun.javafx.tk.quantum.GlassViewEventHandler.handleMouseEvent(Unknown Source)
        at com.sun.glass.ui.View.handleMouseEvent(Unknown Source)
        at com.sun.glass.ui.View.notifyMouse(Unknown Source)
        at com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
        at com.sun.glass.ui.win.WinApplication.access$100(Unknown Source)
        at com.sun.glass.ui.win.WinApplication$2$1.run(Unknown Source)
        at java.lang.Thread.run(Unknown Source)

        The result of this should be a console printout:
        Hello World!
        wooopwoop

        I used:
        Netbeans 7.1
        javafx_sdk-2_0_3
        current release jruby_windows_1_6_7

        You allow me to reopen it, or create a new ticket? Or should I leave you alone with it ?

        Show
        peter added a comment - - edited oh no..I get this error now when I try to run from browser: Hello World! java.lang.NullPointerException at org.jruby.util.OSEnvironment.addRubyKeyValuePair(OSEnvironment.java:101) at org.jruby.util.OSEnvironment.getAsMapOfRubyStrings(OSEnvironment.java:85) at org.jruby.util.OSEnvironment.getEnvironmentVariableMap(OSEnvironment.java:51) at org.jruby.RubyGlobal.defineGlobalEnvConstants(RubyGlobal.java:411) at org.jruby.RubyGlobal.createGlobals(RubyGlobal.java:363) at org.jruby.Ruby.init(Ruby.java:1094) at org.jruby.Ruby.newInstance(Ruby.java:184) at org.jruby.embed.internal.LocalContext.getThreadSafeRuntime(LocalContext.java:69) at org.jruby.embed.internal.ThreadSafeLocalContextProvider.getRuntime(ThreadSafeLocalContextProvider.java:61) at org.jruby.embed.internal.EmbedRubyRuntimeAdapterImpl.runParser(EmbedRubyRuntimeAdapterImpl.java:166) at org.jruby.embed.internal.EmbedRubyRuntimeAdapterImpl.parse(EmbedRubyRuntimeAdapterImpl.java:93) at org.jruby.embed.ScriptingContainer.parse(ScriptingContainer.java:1195) at org.jruby.embed.ScriptingContainer.runScriptlet(ScriptingContainer.java:1255) at javafxapplication1.JavaFXApplication1$1.handle(JavaFXApplication1.java:43) at javafxapplication1.JavaFXApplication1$1.handle(JavaFXApplication1.java:37) at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(Unknown Source) at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source) at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source) at com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(Unknown Source) at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source) at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source) at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source) at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source) at com.sun.javafx.event.EventUtil.fireEventImpl(Unknown Source) at com.sun.javafx.event.EventUtil.fireEvent(Unknown Source) at javafx.event.Event.fireEvent(Unknown Source) at javafx.scene.Node.fireEvent(Unknown Source) at javafx.scene.control.Button.fire(Unknown Source) at com.sun.javafx.scene.control.behavior.ButtonBehavior.mouseReleased(Unknown Source) at com.sun.javafx.scene.control.skin.SkinBase$5.handle(Unknown Source) at com.sun.javafx.scene.control.skin.SkinBase$5.handle(Unknown Source) at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(Unknown Source) at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source) at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(Unknown Source) at com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(Unknown Source) at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source) at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source) at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source) at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source) at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(Unknown Source) at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(Unknown Source) at com.sun.javafx.event.EventUtil.fireEventImpl(Unknown Source) at com.sun.javafx.event.EventUtil.fireEvent(Unknown Source) at javafx.event.Event.fireEvent(Unknown Source) at javafx.scene.Scene$MouseHandler.process(Unknown Source) at javafx.scene.Scene$MouseHandler.process(Unknown Source) at javafx.scene.Scene$MouseHandler.access$1300(Unknown Source) at javafx.scene.Scene.impl_processMouseEvent(Unknown Source) at javafx.scene.Scene$ScenePeerListener.mouseEvent(Unknown Source) at com.sun.javafx.tk.quantum.GlassViewEventHandler.handleMouseEvent(Unknown Source) at com.sun.glass.ui.View.handleMouseEvent(Unknown Source) at com.sun.glass.ui.View.notifyMouse(Unknown Source) at com.sun.glass.ui.win.WinApplication._runLoop(Native Method) at com.sun.glass.ui.win.WinApplication.access$100(Unknown Source) at com.sun.glass.ui.win.WinApplication$2$1.run(Unknown Source) at java.lang.Thread.run(Unknown Source) The result of this should be a console printout: Hello World! wooopwoop I used: Netbeans 7.1 javafx_sdk-2_0_3 current release jruby_windows_1_6_7 You allow me to reopen it, or create a new ticket? Or should I leave you alone with it ?
        Hide
        peter added a comment -

        I will open a new one as it is a different error.

        Show
        peter added a comment - I will open a new one as it is a different error.

          People

          • Assignee:
            Yoko Harada
            Reporter:
            peter
          • Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: