Java 小程序清单 - 允许所有 Caller-Allowable-Codebase [英] Java applet manifest - Allow all Caller-Allowable-Codebase

问题描述

从 Java 7u45 开始，如果网页尝试通过 javascript 与其交互并且该页面未在清单的 Caller-Allowable-Codebase 属性中列出，则小程序将显示警告消息(即使使用受信任的证书签名).

有关此更改的发行说明:

解决方案

删除 Trusted-Library 属性似乎是使 Caller-Allowable-Codebase 正常工作的必要条件，不再有警告.但是，这破坏了 Java 7 Update 21 - 40，它将在所有权限下运行的签名小程序中调用代码的 JavaScript 代码视为混合代码，如果签名的 JAR 文件没有使用 Trusted-Library=true 属性标记，则会引发警告对话框.

As of Java 7u45 an applet will display a warning message (even if signed with a trusted cert) if a webpage tries to interact with it via javascript and that page isn't listed in the manifest's Caller-Allowable-Codebase attribute.

Release notes about this change: http://www.oracle.com/technetwork/java/javase/7u45-relnotes-2016950.html

Oracle blog post about this bug: https://blogs.oracle.com/java-platform-group/entry/7u45_caller_allowable_codebase_and

Attribute description: http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/manifest.html#caller_allowable

I have tried just a wildcard (*), but I still get the warning.

Is there a way around this other than listing all codebases it may run at?

The reason this is a problem for me is that this applet runs on many different machines and networks, but always on intranets at various locations. This applet also needs to communicate with javascript because it talks to local USB scales and displays results and interacts with the page.

Applet in question: https://github.com/JaggedJax/CIO_Scale

解决方案

Removing the Trusted-Library attribute seems to be mandatory to get Caller-Allowable-Codebase working, no more warnings. However, this breaks Java 7 Update 21 - 40 which treated JavaScript code that calls code within a signed applet running with all permissions as mixed code and warning dialogs are raised if the signed JAR files are not tagged with the Trusted-Library=true attribute.

这篇关于Java 小程序清单 - 允许所有 Caller-Allowable-Codebase的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！