Applet Security Interview Questions Part-1

What are applets prevented from doing?
In general, applets loaded over the net are prevented from reading and writing files on the client file system, and from making network connections except to the originating host.

In addition, applets loaded over the net are prevented from starting other programs on the client. Applets loaded over the net are also not allowed to load libraries, or to define native method calls. If an applet could define native method calls, that would give the applet direct access to the underlying computer.

There are other specific capabilities denied to applets loaded over the net, but most of the applet security policy is described by those two paragraphs above. Read on for the gory details.

Can applets read or write files?
In Java-enabled browsers, untrusted applets cannot read or write files at all. By default, downloaded applets are considered untrusted. There are two ways for an applet to be considered trusted:

The applet is installed on the local hard disk, in a directory on the CLASSPATH used by the program that you are using to run the applet. Usually, this is a Java-enabled browser, but it could be the appletviewer, or other Java programs that know how to load applets.

The applet is signed by an identity marked as trusted in your identity database. For more information on signed applets, refer to an example of using signed applets, and to a short description on using javakey.

Sun's appletviewer allows applets to read files that reside in directories on the access control lists.

If the file is not on the client's access control list, then applets cannot access the file in any way. Specifically, applets cannot

check for the existence of the file
read the file
write the file
rename the file
create a directory on the client file system
list the files in this file (as if it were a directory)
check the file's type
check the timestamp when the file was last modified
check the file's size

How do I let an applet read a file?
Applets loaded into a Java-enabled browser can't read files.

Sun's appletviewer allows applets to read files that are named on the access control list for reading. The access control list for reading is null by default, in the JDK. You can allow applets to read directories or files by naming them in the acl.read property in your ~/.hotjava/properties file.


Note: The "~" (tilde) symbol is used on UNIX systems to refer to your home directory. If you install a web browser on your F:\ drive on your PC, and create a top-level directory named .hotjava, then your properties file is found in F:\.hotjava\properties.

For example, to allow any files in the directory home/me to be read by applets loaded into the appletviewer, add this line to your ~/.hotjava/properties file.

acl.read=/home/me

You can specify one file to be read: acl.read=/home/me/somedir/somefile

Use ":" to separate entries: acl.read=/home/foo:/home/me/somedir/somefile

Allowing an applet to read a directory means that it can read all the files in that directory, including any files in any subdirectories that might be hanging off that directory.

How do I let an applet write a file?
Applets loaded into a Java-enabled browser can't write files.

Sun's appletviewer allows applets to write files that are named on the access control list for writing. The access control list for writing is empty by default.

You can allow applets to write to your /tmp directory by setting the acl.write property in your ~/.hotjava/properties file: acl.write=/tmp

You can allow applets to write to a particular file by naming it explicitly:
acl.write=/home/me/somedir/somefile

Use : to separate entries: acl.write=/tmp:/home/me/somedir/somefile

Bear in mind that if you open up your file system for writing by applets, there is no way to limit the amount of disk space an applet might use.

What system properties can be read by applets, and how?
In both Java-enabled browsers and the appletviewer, applets can read these system properties by invoking System.getProperty(String key):
key meaning

java.version Java version number
java.vendor Java vendor-specific string
java.vendor.url Java vendor URL
java.class.version Java class version number
os.name Operating system name
os.arch Operating system architecture
os.version Operating system version
file.separator File separator (eg, "/")
path.separator Path separator (eg, ":")
line.separator Line separator

Applets are prevented from reading these system properties:
key meaning

java.home Java installation directory
java.class.path Java classpath
user.name User account name
user.home User home directory
user.dir User's current working directory

To read a system property from within an applet, simply invoke System.getProperty(key) on the property you are interested in.

For example,
String s = System.getProperty("os.name");