Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #36554

Re: Breaking JNLP apps

Show key headers only | View raw

markspace <markspace@nospam.nospam> wrote:
> On 4/6/2014 1:07 PM, Andreas Leitgeb wrote:
>> I recently posted here about my jnlp-template problems, but either
>> no one saw it or no one knew an answer. No one was inclined to post
>> a followup. The post's subject was
>>    "difficulties with using signed jnlp template"
>> its message-id is: <slrnlf9tf8.ngg.avl@gamma.logic.tuwien.ac.at>
> Here's a blog from Oracle I just happened on.  I wonder if you could 
> leave a comment or use their community features to get feedback on the 
> issue you're having.
> <https://blogs.oracle.com/java-platform-group/entry/new_security_requirements_for_rias>

Ok now, about 3 years later, I've finally been making some progress. I did
get the app running on an 1.8.0_131 client, but face some restrictions,
which (if I can't solve them) would complicate the deployment quite a bit.

The problem is about the jnlp-templates: I can successfully replace *some*
parts like the <jnlp codebase="..."> or <title>...</title> value with a *,
but if I try to use wildcards for a custom property:
    <property name="jnlp.myapp.foo" value="*"/>
in the <resources> section, then the signature verification fails, no
matter what was the actual value in the downloaded myapp.jnlp. (Even,
if it had a literal "*" there thus being equal to the template!)

The question is: how can I freely parameterize aspects of the application
without needing to embed the exact parameterization into the main jar file
and w/o the need to produce a specific signed jar for each possible set of
parameterizations?

Are there other parts of the jnlp more suitable for passing strings to the
app than properties?

Thanks in advance.


PS: the linked page claims the following:

" Some developers may notice that the <security /> element is missing from
" the above JNLP. By providing it within the cryptographically signed JAR
" file, it is no longer necessary within the JNLP for Java 7 update 51
" (January 2014).

This appears to be no longer true with 1.8 (or wasn't ever true to begin
with), as the application kept failing with some misleading error(*), until
I added the <security>...</security> tags back into the jnlp file to match
the Manifest's "Permissions:" entry.    (*): no java console, no exception
text - some dialog popped up suggesting to check the control panel...

Back to comp.lang.java.programmer | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: Breaking JNLP apps Andreas Leitgeb <avl@logic.at> - 2017-04-29 00:11 +0000
  Re: Breaking JNLP apps Andreas Leitgeb <avl@logic.at> - 2017-05-02 18:23 +0000

csiph-web