Andy Herrick e487e25584 6797688: Umbrella: Merge all JDK 6u4 - 6u12 deployment code into JDK7
6845973: Update JDK7 with deployment changes in 6u13, 6u14
4802695: Support 64-bit Java Plug-in and Java webstart on Windows/Linux on AMD64
6825019: DownloadManager should not be loaded and referenced for full JRE
6738770: REGRESSION:JSException throws when use LiveConnect javascript facility
6772884: plugin2 : java.lang.OutOfMemoryError or crash
6707535: Crossing domain hole affecting multiple sites/domains using plug-in
6728071: Non-verification of Update files may allow unintended updates
6704154: Code loaded from local filesystem should not get access to localhost
6727081: Web Start security restrictions bypass using special extension jnlp
6727079: Java Web Start Socket() restriction bypass
6727071: Cache location/user name information disclosure in SingleInstanceImpl
6716217: AppletClassLoader adds permissions based on codebase regardless of CS
6694892: Java Webstart inclusion via system properties override [CVE-2008-2086]
6704074: localhost socket access due to cache location exposed
6703909: Java webstart arbitrary file creation using nativelib
6665315: browser crashes when deployment.properties has more slashes ( / )
6660121: Encoding values in JNLP files can cause buffer overflow
6606110: URLConnection.setProxiedHost for resources that are loaded via proxy
6581221: SSV(VISTA): Redirection FAILS to work if user does a downgrade install
6609756: Buffer Overflow in Java ActiveX component
6608712: Bypassing the same origin policy in Java with crafted names
6534630: "gnumake clobber" doesn't
6849953: JDK7 - replacement of bufferoverflowU.lib on amd64 breaks build
6849029: Need some JDK7 merge clean-up after comments on the webrev
6847582: Build problem on JDK7 with isSecureProperty in merge
6827935: JDK 7 deployment merging - problem in Compiler-msvm.gmk
6823215: latest merge fixes from 6u12 -> JDK7
6816153: further mergers for JDK7 deployment integration
6807074: Fix Java Kernel and JQS in initial JDK7 builds

Initial changeset for implementing 6uX Deployment Features into JDK7

Reviewed-by: dgu, billyh
2009-06-12 14:56:32 -04:00

112 lines
3.8 KiB
Java

/*
* Copyright 2008 Sun Microsystems, Inc. All Rights Reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
* CA 95054 USA or visit www.sun.com if you need additional information or
* have any questions.
*/
/*
* @test
* @bug 6691503
* @summary Checks that there is no opportunity for a malicious applet
* to show a popup menu which has whole screen size.
* a heaviweight popup menu is shown from an applet.
* @author Mikhail Lapshin
* @run main bug6691503
*/
import sun.awt.SunToolkit;
import javax.swing.*;
import java.awt.*;
public class bug6691503 {
private JPopupMenu popupMenu;
private JFrame frame;
private boolean isAlwaysOnTop1 = false;
private boolean isAlwaysOnTop2 = true;
public static void main(String[] args) {
bug6691503 test = new bug6691503();
test.setupUI();
test.testApplication();
test.testApplet();
test.checkResult();
test.stopEDT();
}
private void setupUI() {
SwingUtilities.invokeLater(new Runnable() {
public void run() {
frame = new JFrame();
frame.setVisible(true);
popupMenu = new JPopupMenu();
JMenuItem click = new JMenuItem("Click");
popupMenu.add(click);
}
});
}
private void testApplication() {
SwingUtilities.invokeLater(new Runnable() {
public void run() {
popupMenu.show(frame, 0, 0);
Window popupWindow = (Window)
(popupMenu.getParent().getParent().getParent().getParent());
isAlwaysOnTop1 = popupWindow.isAlwaysOnTop();
System.out.println(
"Application: popupWindow.isAlwaysOnTop() = " + isAlwaysOnTop1);
popupMenu.setVisible(false);
}
});
}
private void testApplet() {
SwingUtilities.invokeLater(new Runnable() {
public void run() {
System.setSecurityManager(new SecurityManager());
popupMenu.show(frame, 0, 0);
Window popupWindow = (Window)
(popupMenu.getParent().getParent().getParent().getParent());
isAlwaysOnTop2 = popupWindow.isAlwaysOnTop();
System.out.println(
"Applet: popupWindow.isAlwaysOnTop() = " + isAlwaysOnTop2);
popupMenu.setVisible(false);
}
});
}
private void checkResult() {
((SunToolkit)(Toolkit.getDefaultToolkit())).realSync();
if (!isAlwaysOnTop1 || isAlwaysOnTop2) {
throw new RuntimeException("Malicious applet can show always-on-top " +
"popup menu which has whole screen size");
}
System.out.println("Test passed");
}
private void stopEDT() {
SwingUtilities.invokeLater(new Runnable() {
public void run() {
frame.dispose();
}
});
}
}