Bug 689157

Can you please test with 1.6.0.0-50.1.8.6.fc13? You can grab the rpms from: http://koji.fedoraproject.org/koji/buildinfo?buildID=226683

Yes, with version 1.6.0.0-50.1.8.6.fc13 it works ok.

Sounds like the fix [1] for CVE-2010-4465 removed clipboard access for untrusted applets. I will look into updating the plugin to work with the fix.

[1] http://icedtea.classpath.org/hg/release/icedtea6-1.8/file/ad0f435608c3/patches/security/20110215/6907662.patch

Note that another problem I have with 1.6.0.0-50.1.8.7.fc13 (a problem that not appeared in 1.6.0.0-37.b17.fc13) is not solved in 1.6.0.0-50.1.8.6.fc13: when the Java applet opens a new window, I can't close that new window with window close button.  Should I open a new bug for this?

(In reply to comment #3)
> Sounds like the fix [1] for CVE-2010-4465 removed clipboard access for
> untrusted applets. I will look into updating the plugin to work with the fix.
> 

Scratch that. I thought I could reproduce this, but I cant any more. I tested the applet with 1.8.7, 1.9.7 and IcedTea-Web and I can copy/paste text inside the applet.

Are you having issues in copying and pasting text between the applet and the rest of the system? If so, I am afraid there is not much I can do - that's pretty much by design. An untrusted applet can not access (read/write) the system clipboard.

(In reply to comment #4)
> Note that another problem I have with 1.6.0.0-50.1.8.7.fc13 (a problem that not
> appeared in 1.6.0.0-37.b17.fc13) is not solved in 1.6.0.0-50.1.8.6.fc13: when
> the Java applet opens a new window, I can't close that new window with window
> close button.  Should I open a new bug for this?

Please do.

(In reply to comment #5)

> Are you having issues in copying and pasting text between the applet and the
> rest of the system? If so, I am afraid there is not much I can do - that's
> pretty much by design. An untrusted applet can not access (read/write) the
> system clipboard.

Between the applet and a terminal (gnome-terminal) yes (and vice versa).  This did always work, till this 1.6.0.0-50.1.8.7.fc13 release.

Untrusted code (like the applet in the example you posted) is not allowed to access the clipboard. From looking at the code, this looks like a very deliberate security decision.

If untrusted applets are allowed to read the system clipboard (which would allow copy/paste to other applications) then the applets could read potentially sensitive information in the clipboard. If applets are allowed to write to the clipboard, then they can DOS the clipboard itself by, say, writing blank strings to it.

I suppose it might be possible to add some logic to distinguish system events (ctrl+c on a JTextField) from programmer generated events, but that would lead to different parts of the applet having different views of the contents on the clipboard.

ever since i updated to java 6 24 i had this problem.

until i added to my java.policy file the following line: 
permission java.awt.AWTPermission "accessClipboard"

i found that here > http://www.sqlinform.com/forum4/read.php?3,467

good luck

This message is a reminder that Fedora 13 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 13.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '13'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 13's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 13 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

(In reply to comment #7)
> Between the applet and a terminal (gnome-terminal) yes (and vice versa).  This
> did always work, till this 1.6.0.0-50.1.8.7.fc13 release.

By design, copy-paste between the system and an untrusted application is not allowed. The fact that it worked was a security vulnerability that was fixed:
http://hg.openjdk.java.net/jdk6/jdk6/jdk/rev/0933d8b8547a

(In reply to comment #9)
> until i added to my java.policy file the following line: 
> permission java.awt.AWTPermission "accessClipboard"

Any applet (even an invisible one written by by a malicious person trying to steal your information form you) running on any web page can read the contents of your clipboard. I dont know how sensitive or personal the information on your clipboard may be, but I wouldn't risk this.

See also the upstream bug: http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=708

Closing as NOTABUG.