Java History. Java History (cont'd)

Size: px

Start display at page:

Download "Java History. Java History (cont'd)"

Pauline Simmons
5 years ago
Views:

Called the language 'Oak' 1 Java History (cont'd) Could not find a market for the technology. During a Sun offsite with Bill Joy in 1994: "why not use it on the Internet?

1 Java History Created by James Gosling et. al. at Sun Microsystems in 1991 "The Green Team" Investigate "convergence" technologies Gosling created a processor-independent language for StarSeven, a 2-way wireless remote-control device Called the language 'Oak' 1 Java History (cont'd) Could not find a market for the technology. During a Sun offsite with Bill Joy in 1994: "why not use it on the Internet?" Started development of "WebRunner", later to be renamed "HotJava" browser a browser capable of downloading and running Java bytecode. Folks were impressed with interactive Web pages e.g., spinning molecules, sorting demos many downloads of HotJava a big success Marc Andersen of Netscape agrees to support Java in Netscape browsers in

2 How Java Applets Work Real-estate on a Web page is set-aside for use by a Java applet via an <embed>, <applet>, or <object> tag (e.g., 2 inches by 3) Java "jar" files downloaded to client machine contains class files other resources (images, sounds, property files, ) Class indicated in the tag (must derive from java.applet.applet) is invoked 3 Applet Execution A JVM (Java Virtual Machine) running within the context of the client browser loads and runs the applet classes. Applet is not trusted. 4 2

3 Java Security The original security model provided by the Java platform is known as the sandbox model, which existed in order to provide a very restricted environment in which to run untrusted code obtained from the Internet Local code is trusted to have full access to vital system resources (such as the file system) Downloaded remote code (an applet) is not trusted and can access only the limited resources provided inside the sandbox 5 JDK 1.0 Security Model sandbox Rely on Type System for Security 6 3

4 ClassLoader Security Trusted part of the JVM Defines a local name space that can be used to ensure that an untrusted applet cannot interfere with the running of other programs Byte Code Verifier Static checks are made against the Java bytecode to ensure it attempts to do nothing improper Like forge a function pointer Treat an integer as a memory address 7 SecuriyManager Security As the applet runs, whenever it needs access to a system resource it asks a trusted SecurityManager for permission. Inspects call stack to determine if call came from Applet or trusted local code. 8 4

5 Java Security! " 9 On 22 March 1996 Security Holes Drew Dean, Ed Felton, and Dan Wallach of the Princeton Dept of Computer Science Successfully exploited a bug in Java to create a applet that deletes a file on the user's local disk. In this bug, a binary library file is first downloaded to the user's local disk using the Netscape caching mechanism. The Java interpreter is then tricked into loading the file into memory and executing it 10 5

6 Security Holes Applets are supposed to be able to talk only to the server that they originated from. However in early March 1996, Steve Gibbons and Dean et al., independently discovered holes in the implementation that allows applets to make connections to any host on the Internet On March 5, 1997, an internal security audit at JavaSoft revealed a bug in the Java bytecode verifier. In theory, this bug could be exploited to bypass the Java Security Manager and execute forbidden operations 11 Java Security JDK 1.1 introduced the concept of a signed applet a correctly digitally signed applet is treated as if it is trusted local code if the signature key is recognized as trusted by the system that receives the applet signed applets, together with their signatures, are delivered in the JAR (Java Archive) format in JDK 1.1, unsigned applets still run in the sandbox 12 6

7 JDK 1.1 Security Model sandbox 13 Java Security Signed applets contain a signature, which is a sequence of characters embedded in the applet's code, placed there by the originator of the applet, and which can't be altered or duplicated The signature tells who the applet comes from, and that the applet has not been tampered with. A signature doesn't tell you anything about the content or quality of the applet, just that it comes from the source it's signed by If an applet is signed with a name you recognize and trust, you can probably have confidence in it 14 7

8 Java Security The applet should generate a Java Security dialog, indicating that a java applet from the sender s signature id" is requesting additional privileges, e.g. reading, modification, or deletion of any of your files. Granting the privilege is noted as high risk The Java Security dialog should indicate "Identity verified by original issuer of certificate" and display a button for you to examine the certificate 15 JDK 1.2 Security JDK 1.2 designed to support easily configurable security policy In JDK 1.2, no longer a built-in concept that all local code is trusted Local code (e.g., non-system code, application packages installed on the local file system) is subject to the same security control as applets The same principles apply to signed applets and any Java application. 16 8

9 JDK 1.2 Security Model sandbox # $ % & & 17 A Trivial Applet Official (new way) of invoking applets (invokes SUN's jre1.3 plug-in) TrivialObject.html Old (and convenient way) of invoking applets (invokes built-in jre) TrivialApplet.html 18 9

10 TrivialObject.html <html> <head> <title>applet Example</title> </head> <body> <h1>below the line is an applet</h1> <hr/> <object classid="clsid:8ad9c e-11d1-b3e f499d93" width="300" height="100" codebase=" win32.cab#version=1,3,0,0"> <param name="code" value="trivial.class"/> <param name="type" value="application/x-java applet;version=1.3"/> </object> </body> </html> 19 TrivialApplet.html <html> <head> <title>applet Example</title> </head> <body> <h1>below the line is an applet</h1> <hr/> <applet code="trivial.class" width="300" height="100"/> </body> </html> 20 10

11 import java.applet.applet; import java.awt.graphics; import java.awt.font; Trivial.java public class Trivial extends Applet { public void paint(graphics g) { g.setfont( new Font("Default", Font.PLAIN, 28) ); g.drawstring("hello, world!", 50, 25); 21 java.applet.applet lifecycle methods void init() invoked when applet is initially loaded void start() invoked when started or restarted as a result of user flipping Web pages void stop() invoked when user switches away from web page void destroy() invoked (usually) on browser termination 22 11

12 Applet contextual methods String getparameter(string) AudioClip getaudioclip(url) Image getimage(url) URL getcodebase() URL getdocumentbase() void showstatus(string) 23 Applet GUI Inherit from Applet and use the AWT GUI library Inherit from JApplet and use the JFC/Swing GUI GUI.html 24 12

13 <html> <head> <title>applet Example</title> </head> GUI.html <body> <h1>between the lines is an applet</h1> <hr> <applet code="gui.class" width="192" height="251"> <param name="image" value="grizzlypenny.jpg"> <param name="sound" value="bearsound.au"> </applet> <hr> </body> </html> 25 GUI.java public class GUI extends Applet { AudioClip sound; Image background; private Button newbutton(string label, ActionListener al) { Button b = new Button(label); b.addactionlistener(al); return b; public void init() { background = getimage(getcodebase(), getparameter("image")); sound = getaudioclip(getcodebase(), getparameter("sound")); Panel buttons = new Panel(); buttons.add( newbutton("play", new ActionListener() { public void actionperformed(actionevent e) { sound.play(); ) ); add("south", buttons); public void paint(graphics g) { g.drawimage(background,0,0,this); 26 13

14 Java/JavaScript Communications JavaScript can call methods defined in Java Applets JS.html 27 JS.html <html> <head> <title>test Applet</title> </head> <body> <h1>this is a test of applets</h1> <hr></hr> <applet name="jsapplet" code="js.class" height="300" width="300"> <param name="text" value="hello World!"></param> Text displayed by non-java enabled browsers </applet> <hr></hr> <form> <input type="button" onclick="alert(document.jsapplet.gettext())" value="get Data From Applet"> </form> </body> </html> 28 14

15 JS.java import java.applet.*; import java.awt.*; public class JS extends Applet { String text = "error"; public void init() { text = getparameter("text"); public void paint(graphics g) { int style = Font.BOLD + Font.ITALIC; g.setfont(newfont("timesroman",style,36)); g.drawstring(text,50,50); public String gettext() { return text; 29 15

Contents 8-1. Copyright (c) N. Afshartous

Contents 8-1. Copyright (c) N. Afshartous Contents 1. Classes and Objects 2. Inheritance 3. Interfaces 4. Exceptions and Error Handling 5. Intro to Concurrency 6. Concurrency in Java 7. Graphics and Animation 8. Applets 8-1 Chapter 8: Applets