I have some problems with opening a SAN switch in Webtools (Java version 8 Update 31).
The first problem was a failed to validate certificate
This was fixed by following the instructions on this site
However, then I got following error:
Which was solved by adding these 3 entries to the site to the exception site list (the last one is the only one necessary I think)
http://i.p.address/*
http://i.p.address/switchExplorer.html
http://i.p.address/
But now I get following error:
your security settings have blocked an application from running due to missing a “permissions” manifest attribute in the main jar web tools
The solution seems to be adding the URL to the exceptions but I have already done that in the previous step..
Open the "Mission Control Panel" of java.
If you cannot find it, have a look in the bin folder of your jdk installation, the executable should be called jcontrol.
Run it, open tab "Security", Button "Edit Site List" and add your URL to the Exception Site List. I.e. https://10.0.0.1 is all you need.
Use oracle java if you use linux and somehow miss jcontrol from the openjdk package.
Afterwards you should be able to start the .jnlp (or however you want to start the applet) of your desire.
My JNLP still works fine after our switch from Java 6 to Java 7, but it now throws a whole series of errors like this:
Missing Application-Name: manifest attribute for: http://blah.com/app.jar
Missing Permissions manifest attribute for: http://blah.com/app.jar
Missing Codebase manifest attribute for: http://blah.com/app.jar
It repeats several times for our main jar and a couple times for one of our library jars. However, it does not occur at all for the bulk of our library jars. JaNeLa lists some optimization opportunities (by changing some defaults), but none of those appear to be related, and no actual errors are found.
So far searching the web has left me empty handed on how to make the JNLP file format into something that Java 7 finds worthy. :-)
See Missing Codebase manifest attribute for:xxx.jar for an explanation for Permissions and Codebase. If you use ant, you can use the following to add the entries to the manifest:
<manifest file="${source}/META-INF/MANIFEST.MF" mode="update">
<attribute name="Permissions" value="all-permissions"/>
<attribute name="Codebase" value="${jnlp.codebase}"/>
<attribute name="Application-Name" value="${app.name}"/>
</manifest>
Java 7 update 45 broke my Web Start SWT application might also have some interesting information
This issue affects both JNLP and applets. The jar files are required to have a permission attribute in the manifest file. I believe the other errors are less critical. The latest JRE shows end users a warning message stating that starting January, 2014 the latest JRE will refuse to run any applet or JNLP jar files with a missing Permissions attribute.
See Java SE7 technotes on manifest.
The Java tutorial has a section on modifying the manifest file but doing this with ant as suggested by #mth sounds simpler.
I could make a self signed java web start application work with a workaround.
Even though I can see warnings in the console, I get no more warnings.
All I needed was:
adding the "Permissions: all-permissions" attribute in the manifest.
Adding the following tag in the jnlp file:
<security>
<all-permissions/>
</security>
signing my jars with my own keystore
importing my own certificate in the Java Control Panel (on Windows).
If you are using maven this can be done by simply adding something like this in your plugin configuration:
<updateManifestEntries>
<Permissions>all-permissions</Permissions>
<Codebase>*</Codebase>
</updateManifestEntries>
Taken from the plugin site here
As of Java 7u45 an applet will display a warning message (even if signed with a trusted cert) if a webpage tries to interact with it via javascript and that page isn't listed in the manifest's Caller-Allowable-Codebase attribute.
Release notes about this change: http://www.oracle.com/technetwork/java/javase/7u45-relnotes-2016950.html
Oracle blog post about this bug: https://blogs.oracle.com/java-platform-group/entry/7u45_caller_allowable_codebase_and
Attribute description: http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/manifest.html#caller_allowable
I have tried just a wildcard (*), but I still get the warning.
Is there a way around this other than listing all codebases it may run at?
The reason this is a problem for me is that this applet runs on many different machines and networks, but always on intranets at various locations. This applet also needs to communicate with javascript because it talks to local USB scales and displays results and interacts with the page.
Applet in question: https://github.com/JaggedJax/CIO_Scale
My findings are the same:
This prevents warnings with Java 7u21 - 7u40:
Manifest-Version: 1.0
Trusted-Library: true
This exclusivly prevents warnings with Java 7u45:
Manifest-Version: 1.0
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
Mixing both won't work in 7u45.
Now what?
Did anyone find a way to allow SIGNED applets with "all-permissions" to run without warnings in both JRE-versions?
What the hell is wrong with oracle?
Removing the Trusted-Library attribute seems to be mandatory to get Caller-Allowable-Codebase working, no more warnings. However, this breaks Java 7 Update 21 - 40 which treated JavaScript code that calls code within a signed applet running with all permissions as mixed code and warning dialogs are raised if the signed JAR files are not tagged with the Trusted-Library=true attribute.
This will be fixed in a future release, according to the oracle blog post:
https://blogs.oracle.com/java-platform-group/entry/7u45_caller_allowable_codebase_and
They recognize the error "Both of these attributes should work together to support the various versions of client installations". But for now, their solution is: "The current work-around would be to favor using Caller-Allowable-Codebase over the old Trusted-Library call. "
I had the same issue. Solution for me was using same parameters in manifest as Oracle used on donwload page in applet for verify java version http://www.java.com/en/download/installed.jsp
Their applet does not popup any warnings.
so solution is:
Manifest-Version: 1.0
Codebase: *
Permissions: all-permissions
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
Application-Name: APPNAME
it works on:
1.7.0_17-b02
1.7.0_25-b17
1.7.0_45-b18
from oracle:
Area: Deployment/Plugin
Synopsis: Caller-Allowable-Codebase may be ignored when used with Trusted-Library.
If a trusted, signed jar is using the Caller-Allowable-Codebase manifest attribute along with Trusted-Library then the Caller-Allowable-Codebase manifest entry will be ignored and, as a result, a JavaScript -> Java call will show the native LiveConnect warning. The workaround is to remove the Trusted-Library manifest entry.
http://www.oracle.com/technetwork/java/javase/7u45-relnotes-2016950.html
The only solution that I can think of that works with 7u45 and the Trusted-Library versions (7u21, 7u25 and 7u40) is to create two different JARs with different manifests and then detecting the user's version and loading the right one.
The main version served to versions before 7u21 and 7u45 and up will have the new Caller-Allowable-Codebase and no Trusted-Library entry. The second version produced will have Trusted-Library and will be served only to 7u21, 7u25 and 7u40.
Here is an ant macro to create the new jar with the modified manifest:
<macrodef name="addtrustedlibrarytojar">
<attribute name="jarpath" />
<attribute name="newjarpath" />
<sequential>
<echo>Unzipping #{jarpath} to add Trusted-Library</echo>
<mkdir dir="build/temp_trusted_library" />
<unjar src="#{jarpath}" dest="build/temp_trusted_library" />
<echo>Inserting Trusted-Library in manifest</echo>
<replaceregexp match="^" replace="Trusted-Library: true${line.separator}" flags="s">
<fileset dir="build/temp_trusted_library/META-INF" includes="MANIFEST.MF"/>
</replaceregexp>
<echo>Creating #{newjarpath}</echo>
<zip file="#{newjarpath}" basedir="build/temp_trusted_library" />
<echo>Deleting build/temp_trusted_library directory</echo>
<delete dir="build/temp_trusted_library" />
</sequential>
</macrodef>
Call the macro like this for each JAR that needs the change made:
<addtrustedlibrarytojar jarpath="dist/myapplet.jar" newjarpath="dist/myapplet_tl.jar" />
Remember to sign the new JAR. If it was signed already this change will invalidate the signature.
We use the PluginDetect library to detect the version of Java. Just extract PluginDetect_Java_Simple.js and getJavaInfo.jar. This code will get the java version:
<script type="text/javascript" src="js/PluginDetect_Java_Simple.js"></script>
<script type="text/javascript">
var javaVersionDetected = '0';
function javaDetectionDone(pd) {
javaVersionDetected = pd.getVersion("Java");
if (console) console.info('Detected java version: ' + javaVersionDetected);
}
PluginDetect.onDetectionDone("Java", javaDetectionDone, "js/getJavaInfo.jar", null);
</script>
We use javascript to launch our applets so we use this to decide between the standard and trusted-library applets:
if (javaVersionDetected === '1,7,0,21' || javaVersionDetected === '1,7,0,25' || javaVersionDetected === '1,7,0,40') {
if (console) console.debug('Using TL applet');
attribs['archive'] = 'applets/myapplet_tl.jar';
}
else {
if (console) console.debug('Using normal applet');
attribs['archive'] = 'applets/myapplet.jar';
}
I had the same issue, So I remove Trusted-Library=true from my MANIFEST.MF, work Caller-Allowable-Codebase attribute fine.
For update 1.7.0_25 (and probably 21-40), setting the security settings to Medium in the Java Control Panel -> Security tab removes prompting when using the manifest tags for update 1.7.0_45.
This set of attributes allows the applet to load without warnings in Java 7u45:
Application-Name: ...
Main-Class: com...
Sealed: true
Codebase: *
Caller-Allowable-Codebase: *
Permissions: all-permissions
We have tested on the following JVMs:
Java 6u20 (OK, well duh!)
Java 7u21 - must include Trusted-Library to avoid warning
Java 7u25 - must include Trusted-Library to avoid warning
Java 7u40 - must include Trusted-Library to avoid warning
Java 7u45
So the long and short is we have a dilemma; to have no warning on 7u21, 7u25 and 7u40 you must include Trusted-Library:true, and to have no warning on 7u45 you must omit this property.
Thanks Oracle for a Kobayashi Maru - we love you.
I'm finding now that some of my users still get this "mixed signed and unsigned code" warning (due to LiveConnect calls in the web page to the applet) even though I've set Caller-Allowable-Codebase correctly, and the difference between those that get it and those that don't get it is whether they have applet .jar file caching enabled in the client host. Those that allow Java to keep temporary files on the client (i.e., allow applet .jar files to be cached) get the warning, and those that turned caching off (because applet caching has never worked quite right) don't get the warning. Go figure.
Without using Trusted-Library and setting:
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
Doesn't work for me, and i still see the warning.
Update: Tried also with http://... but didn't work either.
Update2: Seems even worse. I didnt update 7u40 (to 7u45) but Java console (full debug) shows the "LiveConnect 1.7.45" text. After that, my Javascript->Java calls are blocked.
Update 3: I noticed my warning shows Application and Publisher = UNKNOWN. Altought i have:
Application-Name: MyApplet
Implementation-Vendor: MyCompany
I tried using JDK7u45 instead of JDK7u5 i was using.
To disable this "Security Warning" popup and other related popups using the Java 8 Update 45 JRE.
Trusted-Library: true
Caller-Allowable-Codebase: *.mycompany.com
Note: security warning popup was not disabled with wildcards * and *.com.
We had this problem too - we were building with 1.4.2, on the theory that clients might not have an updated JRE plugin. Despite putting in the new manifest attributes, we still got the popup warnings in the 1.7_u45 JRE. We rebuilt with 1.6, and the warnings went away.
EDIT: As it turns out, our app was doing something different if the file was in a different directory -- specifically, it wasn't attempting to access the applet signed jar manifests. So the fact that the file was in a different directory was irrelevant. So the below information is not accurate. I've decided to detail the real reason for the warning in a new question: As of Java 7 update 45, one can no longer lookup manifest information without triggering a warning?
Unfortunately, the workaround given by Oracle and others here for getting around the update 45 problem does NOT work if your app needs to access files in a different directory than where the app is being run from.
With my web start app, everything worked fine and dandy with the "Trusted-Library" attribute that needed to be added for 7u21. With 7u45, removing the "Trusted-Library" attribute and adding in all the additional attributes talked about in the other answers will NOT work -- I will get the same warning that you would get if you were running 7u21 without the Trusted-Library attribute (stating the application contains both signed and unsigned code).
It took me FOREVER to figure this out, because for very inexplicable reasons Oracle has decided not to print out ANY indication of what the "unsigned" code is in its console, even when running at maximum tracing (level 5). But basically, our app needs access to a configuration file which can be used by the user to configure application properties (for example, the logging level of our app). This configuration file is a plain old text file. And we store the config file in a directory co-located to where the app runs from: ..\config\app.properties. We access this file as a part of the main jar's init routine. It is here where the warning occurs.
The workaround here? Move app.properties into the same directory where the app is running from (and change the reference in the jar to just "app.properties"). Voila, it works -- no more warnings (as long as using the aforementioned codebase attributes). What the hell Oracle???
Unfortunately, because our app allows customized config files on a per-user basis, it is not as simple for us to just put the config file in the app's startup directory -- since that is NOT customized on a per-user basis, we would only be able to allow one user per machine to use the app simultaneously.
I've been looking over Java's manifest documentation to see if there is some way I can make the config file directory "safe" such that loading up of this file doesn't cause the warning. The only thing I can think of is either being able to use the Class-Path attribute or a combination of the Extension attributes (http://docs.oracle.com/javase/7/docs/technotes/guides/plugin/developer_guide/extensions.html), however these all seem designed around the purpose of jars, not just regular files...
Any ideas? And since Oracle intends to fix the Trusted-Library issue anyway, is coming up with a (potentially) grandiose workaround-solution around this even worth the effort? Grrr....
I found some strange thing with MANIFEST.MF file in scope of last Java security issue with new attribute "Caller-Allowable-Codebase".
I had some issues, why this new attribute wasn't helpful for me and started investigation
(Attention!: it may be related only to my local computer configuration - because I had never seen such troubles over stackoverlow).
Manifest file had been upgraded according to new security feature:
Manifest-Version: 1.0
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
and *.jar was build, but without signing.
So, then I unpacked my *.jar file and looked in folder META-INF in MANIFEST.MF, where source manifest.mf should be generated.
And I was embarrassed by absence of last line, it looked this:
Manifest-Version: 1.0
Application-Library-Allowable-Codebase: *
I tested this behavior several times and found out, that last line always was exchanged to the whitespace.
So, if it will be helpfull for someone, just append in the end of MANIFEST.MF file some unmeaningful attribute, like Codebase: *, which will be cutted during *.jar build.
if you make a Manifest patch file remember to live an empty line in the end, otherwise it won´t work.
For example you can make a patch like:
Permissions: all-permissions
Codebase: *
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
But you need to add an empty line (in the example 5 lines instead of four!)
And then add it to the manifest:
jar uvfm jarName.jar permissions.txt
I am writing a Java applet and embedding it in a web page.
It used to run Mac and Windows in different browsers without problem.
I was using NetBeans on the Mac to build the .jar file the applet used.
For some reason or another I decided to load the project on the Windows' NetBeans - I started getting the following error on the Windows machine when accessing the web page from any browser:
java.lang.ClassFormatError: Incompatible magic value 1008813135 in class file
Fearing that it must have been my decision to open the project on Windows that caused this error - I tried to build from the Mac's NetBeans - but the error persisted.
I started a while new project on the Mac and imported the existing source code: still same problem.
I was doing some reading about this error and it seems that the magic number expected is 0xCAFEBABE in hex which is 3405691582 in decimal, not 1008813135. So it looks like the Mac version of Java doesn't produce this file header any more? Hoe can that be? I didn't do any updates or anything.
Yes, 0xCAFEBABE is the usual first 4 bytes of a Java file.
1008813135 is <!DO in Latin encoding, which is, in all probability, the start of <!DOCTYPE....
It is therefore likely the start of a 404 error, or some other error page.
I have not experienced this problem, but Googling this error yields several possible solutions:
forum.sun.com - Java Applet Development - Incompatible magic value 1008813135 in class file MyApplet
Thanks God the problem is solved.
Its the Java cache, so the solution go to Java Control Panel, "General" tab, and under "Temporary Internet Files" click "Settings", then click "Delete Files". Try using the applet again.
"Incompatible magic value 1008813135" Error?
The problem is now solved: I found out that the website host I was using didn't support .jar files at all. I mass-uploaded the files with my ftp program and didn't notice that it ignored the .jar files completely.
Errors on java initialization
Alright, so it was an apache configuration issue, removed this line from my httpd.conf file:
# DefaultType application/x-httpd-php
Fixed the issue.
If you are using Spring security or some sort of custom Servlet Filters, make sure, that the archive or codebase location is in "permitAll" access. This was to problem in my case
I was facing the same problem.The reason in my case was all dependency library that Applet uses was not signed and also applet not able to locate them.
So i Have added all the dependent library along with main applet in jsp file like below :
app.archive = '/esense/resources/lib/Applet.jar, /esense/resources/lib/jasypt-1.7.jar, /esense/resources/lib/mysql-connector-java-5.1.30.jar, /esense/resources/lib/runtime-api-1.0.jar';
I have also signed all the jar.
Hope this may work in your case.
The incompatible magic number is the first four bytes of a html file that has some error message in it, probably a message that the file isn't found.
I encountered this phenomenon when I didn't take case sensitivity into account in the codebase element of the applet tag. Things worked well on Windows, but the internet server I was using was running UNIX where filename case sensitivity is important. Making the case of all file and directory names in the code and codebase elements solved the problem.
I just clicked on maven->update project->include snapshot release in my spring boot and it worked.
This is a problem that only occurs on application update (only tested through Admin Console, not CLI). Also, this is only happening on our development environment, which is identical to our prod env. On uninstall/install, everything is compiled properly. However, this is a large application and it takes long enough to do an update--we do not want to uninstall/install everytime (esp. during dev. builds).
JSP .java and .smap files are being generated, but not .class. On prod, there is no .smap--only .java and .class. If the JSPs would compile, we believe the tag libs would be compiled also.
Has anyone faced this problem, or know what we are possibly overlooking?
WAS Version: 6.1.0.17
EDIT: This is only happening for one JSP and the tag library its using. We're trying to trouble shoot the issue. Let you know if we figure anything out. We think it may be an issue with the .SMAP file per this fix
SOLUTION
Solution:
Problem was: WAS had debugging enabled. This generated .smap files (source mappings) instead of .class files. Once we discovered this, we disabled the debugging service under the Admin Console (Application Servers > server1 > Debugging Processes > uncheck 'Start service'). I don't know why this created a bug upon an update only, but, whatever the case, the problem is solved.
One suggestion:
Have you checked that your environment has a JAVA_HOME pointing to a JDK and not just a JRE. The JRE doesn't have javac, so there won't be any way to compile .java files created at runtime by the JSP compiler into .classes?
EDIT: Also, perhaps this link may help?
I haven't worked with taglibs, but I can tell you this:
the application server checks timestamps. be very very sure that the "modified" timestamps of the JSP files are reasonable from the point of view of the application server (say, are not in the future)
Hope this helps you solve the problem...