Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsWhite Papers
Discussion GroupsFirst AidDatabasesJavaBeansGUIJava 3DVirtual MachineCORBASecurityToolsGeneral
Java DirectoryOpen Source ProjectsSample Book ChaptersUser GroupsWeb Resources
Related Topics
Databases.NETMore Topics ...

Java Forum / General / July 2006

Tip: Looking for answers? Try searching our database.

Untrusted applet/copy conundrum

Thread view: 
Andrew Thompson - 29 Jul 2006 05:11 GMT
Can an untrusted applet provide 'Ctrl C' copy ability
for text fields?

I thought not, but my results are confusing, at best.

Further details (with applet, links to code
and JWS launch, notes..) here.
<http://www.physci.org/test/applet/001/>

Andrew T.
Knute Johnson - 29 Jul 2006 06:41 GMT
> Can an untrusted applet provide 'Ctrl C' copy ability
> for text fields?
[quoted text clipped - 6 lines]
>
> Andrew T.

Andrew:

I'm currently running 1.6.0beta2 on a WinXP machine running Firefox
1.5.0.5 and I can cut, copy, and paste every which way.  I tried both
your JApplet and my own test code using Applet and JApplet.  I tried
your code with IE 6 as well and it worked fine.  The really interesting
thing is that in an Applet, the TextField has a popup menu with Undo,
Cut, Copy, Paste and SelectAll which must be a function of it's Windows
peer.

Signature

Knute Johnson
email s/nospam/knute/

Andrew Thompson - 29 Jul 2006 07:50 GMT
> > Can an untrusted applet provide 'Ctrl C' copy ability
> > for text fields?
...
> I'm currently running 1.6.0beta2 on a WinXP machine running Firefox
> 1.5.0.5 and I can cut, copy, and paste every which way.  ...
(snip further details)

Thanks for the report.  More data to mull over.

Andrew T.
Thomas Hawtin - 29 Jul 2006 10:01 GMT
> Can an untrusted applet provide 'Ctrl C' copy ability
> for text fields?
>
> I thought not, but my results are confusing, at best.

I was under the impression that AWT TextFields could (by nature of their
native nature) and Swing JTextFields could not. As you have found out
this is not the case.

At some point it has been hacked around. What happens is this:

When you the Toolkit generates an event that may represent a copy &
paste action (^X, ^C, ^V, shift-insert, control-insert, middle button,
or whatever) that even is marked as a C&P event in a hidden field. You
cannot create an event like this, and I believe it gets clobbered after
returning from the dispatch. So you can't create or usefully collect one
of these events and the post it to the event queue.

The C&P event handling code checks that there is no user code on the
stack (a highly dubious check, IMO). It checks and clears the hidden
field. If everything is okay, it goes ahead with the action. This stops
you rerouting the event.

What isn't checked is that the text field is actually displaying
anything like a text field. If you were determined, you could make
middle button clicks common in your user interface for non-C&P actions,
or appear to be using C&P internally but actually sneaking a peak at the
system clipboard while faking.

Tom Hawtin
Andrew Thompson - 29 Jul 2006 20:12 GMT
> > Can an untrusted applet provide 'Ctrl C' copy ability
> > for text fields?
[quoted text clipped - 3 lines]
> I was under the impression that AWT TextFields could (by nature of their
> native nature)

Right!  Yeah, I forgot that detail.  It is not of major
relevance to the Swing problem directly, but it may
well provide a solution fo the OP on the original
thread on c.l.j.help, if the Swing copy functionality
turns out to be unsuited to his end user requirement.

Thanks for reminding me.

>...and Swing JTextFields could not. As you have found out
> this is not the case.
(...snip..)

Yeah.. it is very odd.  Or rather, it will probably seem
very less odd after I get a chance to digest your analysis,
..but right now, I'm off to bed.

Thanks for your input.

Andrew T.


Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.