java.lang.SecurityException: Prohibited package name: java

Thread view:

atblock@gmail.com - 17 Jul 2006 23:16 GMT

I created an applet which just attaches an extended TransferHandler to
a gui and it worked fine on my computer...
Online however I got this error: java.lang.SecurityException:
Prohibited package name: java

    at java.lang.ClassLoader.defineClass(Unknown Source)

    at java.security.SecureClassLoader.defineClass(Unknown Source)

    at sun.applet.AppletClassLoader.findClass(Unknown Source)

    at java.lang.ClassLoader.loadClass(Unknown Source)

    at sun.applet.AppletClassLoader.loadClass(Unknown Source)

    at java.lang.ClassLoader.loadClass(Unknown Source)

    at sun.applet.AppletClassLoader.loadCode(Unknown Source)

    at sun.applet.AppletPanel.createApplet(Unknown Source)

    at sun.plugin.AppletViewer.createApplet(Unknown Source)

    at sun.applet.AppletPanel.runLoader(Unknown Source)

    at sun.applet.AppletPanel.run(Unknown Source)

    at java.lang.Thread.run(Unknown Source)

I signed the applet with keytool and jarsigner and it still happened...

Reply to this Message

Andrew Thompson - 17 Jul 2006 23:42 GMT

> I created an applet which just attaches an extended TransferHandler to
> a gui and it worked fine on my computer...

In AppletViewer? Or in a browser?

> Online however I got this error: java.lang.SecurityException:
> Prohibited package name: java

...

> I signed the applet with keytool and jarsigner and it still happened...

Some things cannot be 'fixed' (as being allowable) simply
by signing the applet. A browser, for example, will *always*
throw an exception if you attempt to exit the VM.

BTW - what package(s) are your classes in?

Andrew T.

Reply to this Message

atblock@gmail.com - 17 Jul 2006 23:50 GMT

I checked in AppletViewer and in a Browser and it worked...
There is no package name? (is that possibly the problem?)

> > I created an applet which just attaches an extended TransferHandler to
> > a gui and it worked fine on my computer...
[quoted text clipped - 13 lines]
>
> Andrew T.

Reply to this Message

Andrew Thompson - 18 Jul 2006 02:12 GMT

Please refrain from top-posting - I find it most confusing.

> I checked in AppletViewer and in a Browser and it worked...

What browser (make and version), running which Java?

> There is no package name? (is that possibly the problem?)

Probably not. The problem seem to have to do with a class
in the 'java' package - so it looked as if you were trying
to load your own class declared in the 'java' package, or
trying to create one using the classloader.

You said it wouldn't work on the net. What is the URL
where I can see your applet?

Andrew T.

Reply to this Message

atblock@gmail.com - 18 Jul 2006 02:29 GMT

> Please refrain from top-posting - I find it most confusing.

If what you mean by "top-posting" is posting the response on top, if
people don't like it why did google add this feature into gmail and
google groups?

> > I checked in AppletViewer and in a Browser and it worked...
>
> What browser (make and version), running which Java?

Firefox 1.0.5.4 running java 1.4.2_03

> > There is no package name? (is that possibly the problem?)
>
[quoted text clipped - 5 lines]
> You said it wouldn't work on the net. What is the URL
> where I can see your applet?

http://www.landercollege.net/dev/OLDrooming/webwishingwell/index1.php

Reply to this Message

Andrew Thompson - 18 Jul 2006 04:08 GMT

> > Please refrain from top-posting - I find it most confusing.
>
> If what you mean by "top-posting" is posting the response on top, if
> people don't like it why did google add this feature into gmail and
> google groups?

Google did not. The 'caret' simply defaults to the top of the text
area.
Besides - Google is not a usenet news group, did not invent usenet
news groups, does not own usenet news groups, and does not
control usenet news groups.

> > > I checked in AppletViewer and in a Browser and it worked...
> >
> > What browser (make and version), running which Java?
>
> Firefox 1.0.5.4 running java 1.4.2_03

Thanks. I'd hoped there might be some useful info. there,
but not this time.
...

> > You said it wouldn't work on the net. What is the URL
> > where I can see your applet?
>
> http://www.landercollege.net/dev/OLDrooming/webwishingwell/index1.php

OK. This applet failed before I was asked to 'Accept this
signed code' (or words to that effect). As fas as I can tell,
from that, it is either unsigned, or not properly signed.

Now, when I download the jar file from

http://www.landercollege.net/dev/OLDrooming/webwishingwell/java/Dropper.jar
and look inside it, I can see a Testappl.sf and Testappl.dsa
file, from where it was signed..

That is odd. The only signed .jar I have has the .sf/.dsa
files the same name as the jar file, whereas yours is named
Dropper.jar but the signatures start with Testappl.

I am not sure if it is relevant, but where does the 'Testappl'
name come from?

Andrew T.

Reply to this Message

atblock@gmail.com - 18 Jul 2006 12:33 GMT

> http://www.landercollege.net/dev/OLDrooming/webwishingwell/java/Dropper.jar
> and look inside it, I can see a Testappl.sf and Testappl.dsa
[quoted text clipped - 6 lines]
> I am not sure if it is relevant, but where does the 'Testappl'
> name come from?

keytool allows you to create alias for to sign all your applets. This,
as my first time signing an applet, followed a simple tutorial and
desided to type it exactly what the tutorial writer wrote, in this case
TestApplet or whatever it was

Reply to this Message

Andrew Thompson - 18 Jul 2006 16:31 GMT

Ignore this. I think Thomas found the answer..

Andrew T.

Reply to this Message

atblock@gmail.com - 18 Jul 2006 20:40 GMT

You guys were both wrong...the problem was that i was loading a class
in java/.. when i should have used codebase="java"

Reply to this Message

Thomas Hawtin - 18 Jul 2006 13:10 GMT

>[Andrew Thompason wrote:]
>>[atblock@gmail.com wrote:]
[quoted text clipped - 3 lines]
>> to load your own class declared in the 'java' package, or
>> trying to create one using the classloader.

Loading classes into packages with names starting with java. is
prohibited even from trusted source to stop alteration of the Java
library. (You need to use -XBootclasspath/p: (or -J-XBootclasspath/p: in
appletviewer) to do that.)

>> You said it wouldn't work on the net. What is the URL
>> where I can see your applet?
>
> http://www.landercollege.net/dev/OLDrooming/webwishingwell/index1.php

I'm not about trust code posted to newsgroups, but I did download the
jar and stripped the manifest. The exception I get is:

java.lang.NoClassDefFoundError: Dropper (wrong name: Dropper/Dropper)

Indeed using "javap Dropper" I get:

Compiled from "Dropper.java"
public class Dropper.Dropper extends javax.swing.JApplet{
public Dropper.Dropper();
public void init();
}

Moving the class files into a directory called Dropper solved the
problem. Although you can compile source files with incorrectly named
directories, it's not a good idea. Class files will need to be in the
correct directory. To avoid confusion the convention for packages names
is that they should be all lower case (and preferably a single word).

Tom Hawtin

Signature

Unemployed English Java programmer
http://jroller.com/page/tackline/

Reply to this Message

java.lang.SecurityException: Prohibited package name: java

Free Magazines