Issue222610

classification
Title: SecEx in MS applerviewer
Type: Severity: normal
Components: Core Versions:
Milestone:
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: pedronis Nosy List: bckfnn, pedronis
Priority: normal Keywords:

Created on 2000-11-16.18:01:25 by bckfnn, last changed 2000-11-20.15:45:56 by pedronis.

Messages
msg3 (view) Author: Finn Bock (bckfnn) Date: 2000-11-16.18:01:25
In MS appletviewer, the java load scheme attempts to load the "java" name from sys.path (if the j[p]ython.jar is on CLASSPATH when starting appletviewer). A solution could be to use the Py.frozen flag to avoid filesystem searches.


from java.applet import Applet
class test256a(Applet):
    def __init__(self):
        pass


jpythonc --core --jar test256.jar test256a.py


<applet code="test256a" archive="test256.jar" width=300 height=200></applet>



com.ms.security.SecurityExceptionEx[test256a$_PyInner.main$3]: cannot access file i:\java\Jython.pack\Lib\java
	at com/ms/security/permissions/FileIOPermission.check
	at com/ms/security/PolicyEngine.deepCheck
	at com/ms/security/PolicyEngine.checkPermission
	at com/ms/security/StandardSecurityManager.chk
	at com/ms/security/StandardSecurityManager.checkRead
	at java/io/File.isDirectory
	at org/python/core/imp.loadFromPath
	at org/python/core/imp.loadFromPath
	at org/python/core/imp.load
	at org/python/core/imp.load
	at org/python/core/imp.importName
	at org/python/core/imp.importName
	at org/python/core/ImportFunction.load
	at org/python/core/ImportFunction.__call__
	at org/python/core/PyObject.__call__
	at org/python/core/imp.importFromAs
	at test256a$_PyInner.main$3
	at test256a$_PyInner.call_function
	at org/python/core/PyTableCode.call
	at org/python/core/imp.createFromCode
	at org/python/core/Py.initProxy
	at test256a.<init>
	at java/lang/Class.newInstance
	at com/ms/applet/AppletPanel.processSentEvent
	at com/ms/applet/AppletPanel.run
	at java/lang/Thread.run
msg4 (view) Author: Samuele Pedroni (pedronis) Date: 2000-11-20.15:45:56
Applets should be compiled that way to set Py.frozen true (--deep, ...).
Now (just fixed) if Py.frozen is true:
 sys.path = []
 and the cache is not initiliazed.
So the security violating search will not happen.
History
Date User Action Args
2000-11-16 18:01:25bckfnncreate