DO NOT REPLY [Bug 34359] New: - Cannot use Lucene in an unsigned applet due to Java security restrictions

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=34359>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=34359

           Summary: Cannot use Lucene in an unsigned applet due to Java
                    security restrictions
           Product: Lucene
           Version: CVS Nightly - Specify date in submission
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Other
        AssignedTo: lucene-dev@jakarta.apache.org
        ReportedBy: jons@wrq.com


A few of the Lucene source files call System.getProperty and perform a couple of
other operations within static initializers that assume full Java 2 permissions.
This prevents Lucene from being used from an unsigned applet embedded in a
browser page, since the default security permissions for an applet will prohibit
reading of most properties.

I would suggest wrapping the initialization of the properties in try/catch
blocks. This does mean that a couple properties would need to be made non-final,
and in some cases, getter and setter methods might be desirable to allow the
applet programmer to change the property values at runtime (some variables are
public static and could be changed directly without accessors).

This problem occurs with the shipping 1.4.3 version as well as the latest (as of
 07-apr-2005) source code fetched from CVS.

Currently, the files that are affected are org.apache.lucene.index.IndexWriter,
org.apache.lucene.index.SegmentReader, org.apache.lucene.search.BooleanQuery,
and org.apache.lucene.store.FSDirectory.

I have modified versions of these files with some suggested changes, plus a
simple test applet and associated files that demonstrate the situation. The
sample applet can be launched in a browser either by double-clicking the file
locally or by putting it on a web server and launching it from an http URL. As
soon as I can figure out how to attach to a bug report, I'll do that.

P.S. This topic came up in August, 2004 in lucene dev mailing list but as far as
I can tell, has not yet been resolved.

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: java-dev-help@lucene.apache.org