Java 如何授予站点的小程序 AllPermission 权限？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/2828075/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How do I grant a site's applet an AllPermission privilege?
提问by nahsra
I'd like to specify certain applets to run with java.security.AllPermissionon my computer (for debugging and security testing). However, I don't want to enable allapplets that I run to have this permission. So, editing my user Java policy file (which I have ensured is the correct policy file through testing), I try to put this value:
我想指定java.security.AllPermission在我的计算机上运行的某些小程序（用于调试和安全测试）。但是，我不想让我运行的所有小程序都拥有此权限。因此，编辑我的用户 Java 策略文件（我已通过测试确保它是正确的策略文件），我尝试设置此值：
grant codeBase "http://host_where_applet_lives/-" {
permission java.security.AllPermission;
};
This value fails when the applet tries to do something powerful (create a new Thread, in my case). However, when I put the following value:
当小程序尝试做一些强大的事情（在我的情况下创建一个新线程）时，此值失败。但是，当我输入以下值时：
grant {
permission java.security.AllPermission;
};
The applet is able to perform the powerful operation. The only difference is the lack of a codeBaseattribute.
小程序能够执行强大的操作。唯一的区别是缺少codeBase属性。
An answer to a similar question asked here [1] seemed to suggest (but never show or prove) that AccessController.doPrivileged()calls may be required. To me, this sounds wrong as I don't need that call when I grant the permissions to all applets (the second example I showed). Even if this is a solution, littering the applets I run with AccessController.doPrivileged()calls is not easy or necessarily possible. To top it off, my tests show that this just doesn't work anyway. But I'm happy to hear more ideas around it.
此处 [1] 中提出的类似问题的答案似乎暗示（但从未显示或证明）AccessController.doPrivileged()可能需要调用。对我来说，这听起来不对，因为当我向所有小程序授予权限时我不需要那个调用（我展示的第二个例子）。即使这是一个解决方案，用AccessController.doPrivileged()调用来乱扔我运行的小程序也不是容易的，也不一定是可能的。最重要的是，我的测试表明这无论如何都行不通。但我很高兴听到更多关于它的想法。
[1] Can't get AllPermission configured for intranet applet. Can anyone help?
回答by alsmola
The answer to the similar questionyou referenced suggests that calling Java applet code from JavaScript may lead to a SecurityExceptionbecause the AccessControllerwill do a stack inspectionand fail because of the untrusted JavaScript. I tried out the code and sure enough, Firefox won't run the applet called by JavaScript without a doPrivileged()call but Safari will (at least on Mac OSX).
您引用的类似问题的答案表明，从 JavaScript 调用 Java 小程序代码可能会导致 a，SecurityException因为它AccessController会进行堆栈检查并由于不受信任的 JavaScript 而失败。我尝试了代码，果然，Firefox 不会在没有调用的情况下运行 JavaScriptdoPrivileged()调用的小程序，但 Safari 会（至少在 Mac OSX 上）。
If you are calling your applet from JavaScript, you could try using the Applet.paint()method instead to automatically invoke your applet. Or, you could use the doPrivileged()method to short-circuit the stack inspection, and give yourself whatever privilege you need. Of course, then any untrusted code would be able to call into your privileged code.
如果您从 JavaScript 调用您的小程序，您可以尝试使用该Applet.paint()方法来自动调用您的小程序。或者，您可以使用该doPrivileged()方法短路堆栈检查，并为自己提供所需的任何特权。当然，任何不受信任的代码都可以调用您的特权代码。
