java.security.AccessControlException：访问被拒绝（java.util.PropertyPermission http.agent 读取）
我有一个未签名的 java 小程序与同一主机交互。每次我单击页面中的元素时，小程序（这是我无法控制的第三方小程序）应该从 URL 加载数据。我说应该，因为对于某些文件，我得到
java.security.AccessControlException ：访问被拒绝（java.util.PropertyPermission http.agent read）
并且其他一些文件已正确加载。所有文件都可以从网络服务器正确读取和下载，并且它们是非常简单的文本文件。
我还发现，在某些情况下，以前返回错误的文件现在会加载并继续加载，因此似乎以某种方式涉及缓存。
你们中有人知道这里发生了什么吗？这种行为似乎是绝对随机的，我无法对此进行调试。注意：我使用这个小程序执行许多其他“单次”文件访问，并且它从未给我带来任何问题。唯一明显的区别是，现在我通过 JavaScript 事件“按需”执行此操作。
在小程序的 java 中或其他任何地方可能是什么原因？
I have a non-signed java applet interacting with the same host. Every time I click on an element in my page, the applet (which is a third part applet I have no control on) should load data from a URL. I say should, because for some files, I get
java.security.AccessControlException : access denied (java.util.PropertyPermission http.agent read)
and some other files are correctly loaded. All files are correctly readable and downloadable from the web server, and they are very simple text files.
I also found that, in some cases, files that previously returned the error are now loaded and continue to load, so it seems a cache is involved somehow.
Does any of you have an idea of what's going on here ? The behavior seems to be absolutely random, and I have no way of performing debug on this thing. Note: I used this applet to perform many other "single shot" file access, and it never gave me any problem. The only apparent difference I have is that now I do it "on-demand" via a javascript event.
What could be the cause, in the java of the applet or anywhere else ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这是 Java VM 中的一个错误。 https://bugs.java.com/bugdatabase/view_bug?bug_id=6593830 这个问题似乎只发生在小程序中。 Java Web Start 似乎不受影响。
This is a bug in the Java VM. https://bugs.java.com/bugdatabase/view_bug?bug_id=6593830 This problem seems only occur with an applet. Java Web Start seems not affected.
一些
http和httpsURL 处理程序使用http.agent来设置User-Agent标头。处理此问题的正确方法是，无论是否授予权限（与许多其他权限一样），都可以使用此特定系统属性的副本。但是，所做的是将其添加到赋予小程序和 JNLP 应用程序的权限中。这意味着，如果通过其他机制加载任何代码（例如通过 LiveConnect 从 JavaScript 进行调用），它将不具有权限，并且可能会失败。如果该项目已被缓存，则无需写入 HTTP 标头，因此无需读取该属性。
Some
httpandhttpsURL handlers use thehttp.agentto set theUser-Agentheader.The correct way to handle this would be to make a copy of this particular system property available whether the permission is granted or not (as with a number of others). However, what has been done is to add it on to the permissions give to applets and JNLP apps. This means that if any code is loaded through another mechanism (say a call from JavaScript over LiveConnect), it wont have the permissions and there might be a failure. If the item is already cached, then there wont be a need to write a HTTP header, and therefore the property need not be read.
小程序坏了。它试图访问沙箱安全规则规定它不能访问的属性的值。
将此情况报告给小程序的供应商，并请求错误修复或解决方法。
The applet is broken. It is trying to access the value of a property that the sandbox security rules say that it cannot.
Report this to the supplier of the applet, and ask for a bug fix or workaround.