# TRUSTED APPLET AND CLASS LOADER

celopez (celopez@gran-via.com)
Thu, 08 Apr 1999 12:04:35 +0200

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Kimberley M. Cross: "Help! Need expert troubleshooter's assistance! and help with Java plugin 1.1.1"
- Previous message: Jan Luehe: "Re: JCE1.2 -- Blowfish has no KeyFactory?"

    Date: Thu, 08 Apr 1999 12:04:35 +0200

    From: celopez <celopez@gran-via.com>

    To: java-security@java.sun.com

    Subject: TRUSTED APPLET AND CLASS LOADER

--------------9B5DD661A8EA94A07D4C56A1
Content-Type: text/plain; charset="us-ascii"
X-Sun-Content-Length: 1506

This is a mail to java-security@java.sun.com from Vishal Shah. I have a
problem that looks like that. Can anyone help me? Thanks.
Hello everyone,

I'd like to know if the trusted applet ( digitally signed, and the
signature can be verified by trusted third-pary CA) can subclass the
classloader in the JDK 1.1 compliant web-browser ?

What I want is to read from user's local machine/anywhere from the
network
a class and instantiate/run it.

The problem comes as I cannot subclass classLoader and hence cannot
override methods defineClass/loadClass/resolveClass.

I was only able to use class.forName() method because it does not use
classLoader. But this method does not give me any ability to read from
users' local storage or network. So, as a workaround I have written
applet to read a specific class from user's machine, upload that class
to
a cgi script on my web-server that copies the class in the class-path of

my server, and then load the class by class.forName() method. But this
method has the overhead of transmitting entire class back and forth.

Is there any other way to do this ?

There are definately security implications if classLoader allow
arbitrary
classes to load from network. My question is is it permitted in trusted
applet in 1.1 implementation or not?

If it is not permitted than besides classLoader which others classes are

protected ? Does it depend on implementation or determined by specs ?

I appreciate any pointers/solutions.

Best regards,

Cecilio Lopez

--------------9B5DD661A8EA94A07D4C56A1
Content-Type: text/html; charset="us-ascii"
X-Sun-Content-Length: 1844

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
This is a mail to java-security@java.sun.com from Vishal Shah. I have a problem that looks like that. Can anyone help me? Thanks.
Hello everyone,

I'd like to know if the trusted applet ( digitally signed, and the
signature can be verified by trusted third-pary CA) can subclass the
classloader in the JDK 1.1 compliant web-browser ?

What I want is to read from user's local machine/anywhere from the network
a class and instantiate/run it.

The problem comes as I cannot subclass classLoader and hence cannot
override methods defineClass/loadClass/resolveClass.

I was only able to use class.forName() method because it does not use
classLoader. But this method does not give me any ability to read from
users' local storage or network. So, as a workaround I have written
applet to read a specific class from user's machine, upload that class to
a cgi script on my web-server that copies the class in the class-path of
my server, and then load the class by class.forName() method. But this
method has the overhead of transmitting entire class back and forth.

Is there any other way to do this ?

There are definately security implications if classLoader allow arbitrary
classes to load from network. My question is is it permitted in trusted
applet in 1.1 implementation or not?

If it is not permitted than besides classLoader which others classes are
protected ? Does it depend on implementation or determined by specs ?

I appreciate any pointers/solutions.

Best regards,

Cecilio Lopez

--------------9B5DD661A8EA94A07D4C56A1--

- Next message: Kimberley M. Cross: "Help! Need expert troubleshooter's assistance! and help with Java plugin 1.1.1"
- Previous message: Jan Luehe: "Re: JCE1.2 -- Blowfish has no KeyFactory?"