如何愚弄的Java服务提供商的API（JAXP） [英] How to Fool the Java Service Provider API (jaxp)
问题描述
我有需要调用JAXP小应用程序，特别是<一个href=\"http://download.oracle.com/javase/1.5.0/docs/api/javax/xml/parsers/SAXParserFactory.html#newInstance%28%29\"相对=nofollow>的SAXParserFactory 。现在，你可以从Javadoc中看到，这个在内部使用的文件服务提供机制的这里：
I have an applet that needs to call JAXP, specifically SAXParserFactory. Now, as you can see from the Javadoc, this internally uses the Service Provider mechanism as documented here:
特别是，如果它不以任何我称为应用程序JAR的查找文件 META-INF /服务/ javax.xml.parsers.SAXParserFactory中的它会尝试获取从我的应用程序codeBase的。如果我有我的小应用程序部署如下：
Specifically, if it does not find a file in any of my application JARs called META-INF/services/javax.xml.parsers.SAXParserFactory it will try to fetch it from my application codebase. If I have my applet deployed as follows:
<applet code="com.example.applets.MyApplet"
codebase="http://www.example.com/myapp/" archive="myapp.jar, dom4j.jar">
然后，它会尝试让一个HTTP请求的http://www.example.com/myapp/META-INF/services/javax.xml.parsers.SAXParserFactory
我宁愿它没有这样做，特别是因为我的小程序签署与本附加HTTP调用触发有关的无符号code 。
I'd rather it not do that, specifically because my applet is signed and this additional HTTP call triggers a warning about unsigned code.
现在，很明显的解决方法就是把META-INF / services文件在我的应用程序JAR像它说，但我怎么做，但仍得到它使用JAXP的用户的JRE默认实现？或者，有没有办法说服小程序运行时看的只有的在我的JAR文件，而不是在 codeBase的该文件？
Now, the obvious solution is to just put the META-INF/services file in my application JAR like it says, but how do I do that yet still get it to use the user's JRE default implementation of JAXP? Alternately, is there a way to convince the applet runtime to look only in my JAR files and not in the codebase for that file?
注：我知道，我也可以部署自己的JAXP-RI的副本，但是是pretty重量级的一个小程序
Note: I know I could also deploy my own copy of JAXP-RI but that's pretty heavy-weight for an applet.
推荐答案
禁用codeBase的查询：
Disable the codebase lookup:
<applet ...>
<param name="codebase_lookup" value="false">
</applet>
的 AppletClassLoader 检查布尔属性 sun.applet.AppletClassLoader。codebaseLookup ，它可以是通过设置上述参数的影响。该方法 sun.applet.AppletPanel.init（）将读取参数，设置成 AppletClassLoader 。一旦禁用，AppletClassLoader将停止生产在codeBase的类和资源远程查找，由 codeBase类=http://www.example.com/myapp给出的URL /，只考虑到档案和系统类路径。
The AppletClassLoader checks for a boolean property sun.applet.AppletClassLoader.codebaseLookup, which can be influenced by setting the above parameter. The method sun.applet.AppletPanel.init() will read the parameter and set it into the AppletClassLoader. Once disabled, the AppletClassLoader will stop making remote lookups for classes and resources in the codebase, that is the URL given by codebase="http://www.example.com/myapp/" and only look into the archives and system class paths.
请注意：我没有这个测试自己，但根据反汇编code code审核，老实说，我相信它可以工作
Note: I did not test this myself, but according to code review in the disassembled code, i honestly believe it could work.
它也记录在<一个href=\"http://download.oracle.com/javase/6/docs/technotes/guides/plugin/developer_guide/special_attributes.html\">JavaSE - 技术说明 - 插件开发者指南 - 特殊属性的：
codebase_lookup
在该小程序的类加载器需要加载一个类或资源（例如，用于在META-INF /服务目录下可插入的服务提供者配置文件），它用于在该小程序的JAR文件所需的文件首先搜索，然后从小程序codeBase的。通常小程序被部署与所有存储的小应用程序的JAR文件所需的类和资源。在此情况下，codeBase的查找是不必要的。
When the applet classloader needs to load a class or resource (for example, configuration files for pluggable service providers under the META-INF/services directory), it first searches for the required files in the applet JAR files and then from the applet codebase. Typically applets are deployed with all the needed classes and resources stored in the applet JAR files. In this case, the codebase lookup is unnecessary.
如果类或资源不可用从applet JAR文件，它可能是最好有类加载器的失败，而不是尝试codeBase的查找。否则，一个连接到制成的小程序codeBase的要搜索的类或资源，并且可能对小程序的运行时性能的影响。
If the class or resource is not available from the applet JAR files, it may be better to have the classloader fail rather than attempt a codebase lookup. Otherwise, a connection has to be made to the applet codebase to search for the class or resource, and it may have performance impact on the applet runtime.
这篇关于如何愚弄的Java服务提供商的API（JAXP）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
