JNLPAppletLauncher can't find subApplet class name since Java update 21

Question

Since JRE version 1.6.0_21-b07 org.jdesktop.applet.util.JNLPAppletLauncher can't find the class contained in the parameter subapplet.classname anymore. In https://applet-launcher.dev.java.net/source/browse/applet-launcher/trunk/src/org/jdesktop/applet/util/JNLPAppletLauncher.java?rev=41&view=log your name appears in revision 41 for improved class loading of the subapplet. If this is really you can you have a look at it?

Kind regards,

Henri Manson

Answer 1

I don't know the specific reason you are finding JNLPAppletLauncher will not find your applet, but I can give some background:

JNLPAppletLauncher was a signed jar designed to be usable with untrusted code. Mixing trusted and untrusted code like that is actually a vulnerability. Under the 6u19 mixed code fix, mixing code like this should cause a security warning dialog.

The likes of the JNLPAppletLauncher jar should now be marked with Trusted-Library: true in the manifest. The code may need changes (cited in the question) to use the applet class-loader rather than the parent trusted-library class-loader.

In order to avoid the security warning dialog appearing using certain pre-6u19 jars, some are recognised (using the same implementation as the blacklist feature) and are executed as if they had opted into the Trusted-Library feature. If you rebuild the jar, it will not be recognised and will require the manifest entry.

Kind regards,

Tom Hawtin