copy-paste in an applet, SwingSet

Thread view:

mitch - 07 Jun 2005 15:13 GMT

I have an applet where copy-paste isn't working, and reading the
archives, I see that this is an intentional security feature to
protect the clipboard against malicious applets.

However I see that copy-paste works in the SwingSet demo:

http://java.sun.com/products/plugin/1.3.1_01a/demos/jfc/SwingSet2/SwingSet2Plugi
n.html

The JEditorPane (5th button from the left) has text that is copyable
using ^v on Windows.

I wonder if SwingSet is a signed applet, or if Sun used some other
trick to make the text copyable. Does anybody know? When I run the
applet I don't see any dialog box about a signed applet, and I don't
see anything in the Java Console. Any ideas why copying text from
this applet to the system clipboard works? Thanks.

Reply to this Message

Andrew Thompson - 07 Jun 2005 16:01 GMT

> I have an applet where copy-paste isn't working,

Isn't working? No - it works just fine.

>..and reading the
> archives, I see that this is an intentional security feature to
> protect the clipboard against malicious applets.

Which simply means that the applet sandbox works just
fine to jump on any attempt to programatically copy/paste
to the clipboard..

> However I see that copy-paste works in the SwingSet demo:
>
> http://java.sun.com/products/plugin/1.3.1_01a/demos/jfc/SwingSet2/SwingSet2Plugi
n.html

It also works in this applet..
<http://www.physci.org/test/lnf/fullwnd5.html>

> The JEditorPane (5th button from the left) has text that is copyable
> using ^v on Windows.

Paste does not work in the main text area simply because it
is not editable, but click the 'Input' button for the dialog,
and you can see that ^a, ^c, and ^v all work in both the
text field and text area.

> I wonder if SwingSet is a signed applet, ..

No, you would have got a big, friendly warning from your local
JVM that this was signed code, and did you wish to run it in
signed mode?

>..or if Sun used some other trick to make the text copyable.

Like Sun are about to expose a flaw in the applet security sandbox
by featuring it in the Swingset demo. Yur funny. [ ;-) ]

You can compile it from the source and see that it works for yourself.

>..Does anybody know?

I take you back to 'programatically', since an applet might
pinch (steal) information from the clipboard, or be really
irritating and copy '' to the clipboard every 50msec.
Therefore the applet security sandbox does not allow an
unsigned applet to copy <-> clipboard, but the *user* still can.

HTH

Signature

Andrew Thompson
http://www.PhySci.org/codes/ Web & IT Help
http://www.PhySci.org/ Open-source software suite
http://www.1point1C.org/ Science & Technology
http://www.LensEscapes.com/ Images that escape the mundane

Reply to this Message

mitch - 07 Jun 2005 21:42 GMT

> > I have an applet where copy-paste isn't working,
>
[quoted text clipped - 52 lines]
> http://www.1point1C.org/ Science & Technology
> http://www.LensEscapes.com/ Images that escape the mundane

Reply to this Message

mitch - 08 Jun 2005 17:02 GMT

Looking through the archives of this group, there are a lot
of references like this one

http://groups-beta.google.com/group/comp.lang.java.gui/browse_frm/thread/aafff5b
e785ddf05/4e91cd95e293c57f?q=applet+clipboard&rnum=2&hl=en#4e91cd95e293c57f

saying that applets can't access the clipboard because of
security. However something seems to have changed in JRE
1.5 and it's working in some applets such as SwingSet and the
one you referred to.

However it's curious. In the applet I'm paid to work on,
copying with ^c just copies to a clipboard inside the applet.
I can paste to another part of the applet but not to a Windows
application like Notepad. This is using JRE 1.5. It seems like
some code is inadvertently making it so copy-paste does not
work using the system clipboard. Does anybody know of a way
that an applet could accidentally be disabling this feature?
Thanks.

Reply to this Message

Andrew Thompson - 08 Jun 2005 17:22 GMT

> However it's curious. In the applet I'm paid to work on,

What applet? ...

> copying with ^c just copies to a clipboard inside the applet.

The user can copy in Swingset2 just fine, same with my applet,
no code signature, no tricks - nothing.

..It seems like it is time _you_ produced an SSCCE* that
demonstrates the problem you describe.
* <http://www.physci.org/codes/sscce.jsp>

Signature

Reply to this Message

Roland - 08 Jun 2005 20:49 GMT

> Looking through the archives of this group, there are a lot
> of references like this one
[quoted text clipped - 5 lines]
> 1.5 and it's working in some applets such as SwingSet and the
> one you referred to.

Yes that is true. There's a slightly different behaviour between 1.5 and
1.4.2 (and older).

> However it's curious. In the applet I'm paid to work on,
> copying with ^c just copies to a clipboard inside the applet.
> I can paste to another part of the applet but not to a Windows
> application like Notepad.

Yep. It's a kind of internal clipboard.

> This is using JRE 1.5.

Are you sure that your browser is running 1.5 and not an older version.
You could use the test applet to find out
<http://java.com/en/download/help/testvm.xml>

> It seems like
> some code is inadvertently making it so copy-paste does not
> work using the system clipboard. Does anybody know of a way
> that an applet could accidentally be disabling this feature?
> Thanks.

How did you code the copy and paste functionality?
Are you using Swing's built-in capability of its text components, or are
you accessing the system clipboard programmatically yourself, using
something like
Toolkit.getDefaultToolkit().getSystemClipboard();

In the first case, I don't know why it's not working on JRE1.5. [I
haven't figured out (yet?) why Ctrl-C and Ctrl-V are able to access the
system clipboard in JRE1.5.]

If you use getSystemClipboard() you may encounter a SecurityException
(in 1.5 *and* in 1.4 and older) unless your applet owns the
AWTPermission to access the clipboard (either because the applet is
signed or the permission has explitictly been assigned to your applet)

Signature

Regards,

Roland de Ruiter
` ___ ___
`/__/ w_/ /__/
/ \ /_/ / \

Reply to this Message

Andrew Thompson - 08 Jun 2005 21:41 GMT

...

> Are you sure that your browser is running 1.5 and not an older version.
> You could use the test applet to find out
> <http://java.com/en/download/help/testvm.xml>

(harumph!) Sun has finally gained the sense to put up some simple
testing applet's like mine[1] and Roedy's[2]. [ Ours are better though. ]

[1] <http://www.physci.org/pc/property.jsp?prop=java.version+java.vendor>
[2] <http://mindprod.com/wassup.html>

Signature

Reply to this Message

Roland - 09 Jun 2005 12:18 GMT

> ...
>><http://java.com/en/download/help/testvm.xml>

[...]

> (harumph!) Sun has finally gained the sense to put up some simple
> testing applet's like mine[1] and Roedy's[2].

It's there since at least the beginning of this year.

> [ Ours are better though. ]

Of course you're entitled to have a biased opinion.

> [1] <http://www.physci.org/pc/property.jsp?prop=java.version+java.vendor>
> [2] <http://mindprod.com/wassup.html>

Signature

Regards,

Roland de Ruiter
` ___ ___
`/__/ w_/ /__/
/ \ /_/ / \

Reply to this Message

Andrew Thompson - 09 Jun 2005 13:25 GMT

>> ...
>>><http://java.com/en/download/help/testvm.xml>
> [...]
>> (harumph!) Sun has finally gained the sense to put up some simple
>> testing applet's like mine[1] and Roedy's[2].
> It's there since at least the beginning of this year.

I have been a bit busy and am only just catching up on 'recent' events.

>> [ Ours are better though. ]
> Of course you're entitled to have a biased opinion.

Well, I think 'biased' is a bit harsh, but perhaps I
should have focused the original statement to ..
'ours are better for *Java* *developers*'

This is the case for several reasons..

The mindprod.com applet is signed, and provides access
to the entire range of system properties if the user accepts
the signed code, if the user refuses full access, it provides
the 'safe' properties.

OTOH, my applet is not signed, and is lighterweight because of it.
It can show a developer the properties that they can access in
an unsigned applet, and indicate (list) some of the ones they cannot
access in unsigned code. The page that my applet resides in has
the ability to alter the applet tag to higlight any property
or group of properties, so a user can be asked for a specific
property ('What is your Java version?') via the query string of
the link.

Both the mindprod and my properties apps also work as applications.

OTOH, the Sun version is clearly better for the end user.

- It checks that the user has the most current Java and
encourages them to upgrade if they do not.
- It has a cute little animated 'Duke' at the bottom.

So.. would you agree that Sun's applet is not necessarily the
best one for *Java* *developers*?

Signature

Reply to this Message

copy-paste in an applet, SwingSet

Free Magazines