Bug 689157 - Copy/paste from/to Java applets does not work anymore
Copy/paste from/to Java applets does not work anymore
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: java-1.6.0-openjdk (Show other bugs)
13
x86_64 Linux
unspecified Severity high
: ---
: ---
Assigned To: Omair Majid
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-03-19 19:13 EDT by Jos Vos
Modified: 2011-06-01 14:17 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-06-01 14:17:23 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jos Vos 2011-03-19 19:13:03 EDT
Description of problem:
Since the upgrade of java-1.6.0-openjdk (and the plugin) to version 1.6.0.0-50.1.8.7.fc13 copy/paste from/to Java applets doe snot work anymore.

Version-Release number of selected component (if applicable):
1.6.0.0-50.1.8.7.fc13

How reproducible:
See for example http://www.finnzymes.com/tm_determination.html (but the problem appears in all Java applets I tried) and try to copy/paste text from/to the first input field in the applet. This does not work with version 1.6.0.0-50.1.8.7.fc13, but it does work with version 1.6.0.0-37.b17.fc13.  I downgraded java-1.6.0-openjdk and java-1.6.0-openjdk-plugin to the latter version now it's working again.
Comment 1 Omair Majid 2011-03-21 10:59:47 EDT
Can you please test with 1.6.0.0-50.1.8.6.fc13? You can grab the rpms from: http://koji.fedoraproject.org/koji/buildinfo?buildID=226683
Comment 2 Jos Vos 2011-03-21 11:12:46 EDT
Yes, with version 1.6.0.0-50.1.8.6.fc13 it works ok.
Comment 3 Omair Majid 2011-03-21 11:28:35 EDT
Sounds like the fix [1] for CVE-2010-4465 removed clipboard access for untrusted applets. I will look into updating the plugin to work with the fix.

[1] http://icedtea.classpath.org/hg/release/icedtea6-1.8/file/ad0f435608c3/patches/security/20110215/6907662.patch
Comment 4 Jos Vos 2011-03-21 14:22:19 EDT
Note that another problem I have with 1.6.0.0-50.1.8.7.fc13 (a problem that not appeared in 1.6.0.0-37.b17.fc13) is not solved in 1.6.0.0-50.1.8.6.fc13: when the Java applet opens a new window, I can't close that new window with window close button.  Should I open a new bug for this?
Comment 5 Omair Majid 2011-03-21 17:52:12 EDT
(In reply to comment #3)
> Sounds like the fix [1] for CVE-2010-4465 removed clipboard access for
> untrusted applets. I will look into updating the plugin to work with the fix.
> 

Scratch that. I thought I could reproduce this, but I cant any more. I tested the applet with 1.8.7, 1.9.7 and IcedTea-Web and I can copy/paste text inside the applet.

Are you having issues in copying and pasting text between the applet and the rest of the system? If so, I am afraid there is not much I can do - that's pretty much by design. An untrusted applet can not access (read/write) the system clipboard.
Comment 6 Omair Majid 2011-03-21 17:52:25 EDT
(In reply to comment #4)
> Note that another problem I have with 1.6.0.0-50.1.8.7.fc13 (a problem that not
> appeared in 1.6.0.0-37.b17.fc13) is not solved in 1.6.0.0-50.1.8.6.fc13: when
> the Java applet opens a new window, I can't close that new window with window
> close button.  Should I open a new bug for this?

Please do.
Comment 7 Jos Vos 2011-03-23 12:07:22 EDT
(In reply to comment #5)

> Are you having issues in copying and pasting text between the applet and the
> rest of the system? If so, I am afraid there is not much I can do - that's
> pretty much by design. An untrusted applet can not access (read/write) the
> system clipboard.

Between the applet and a terminal (gnome-terminal) yes (and vice versa).  This did always work, till this 1.6.0.0-50.1.8.7.fc13 release.
Comment 8 Omair Majid 2011-03-24 14:19:34 EDT
Untrusted code (like the applet in the example you posted) is not allowed to access the clipboard. From looking at the code, this looks like a very deliberate security decision.

If untrusted applets are allowed to read the system clipboard (which would allow copy/paste to other applications) then the applets could read potentially sensitive information in the clipboard. If applets are allowed to write to the clipboard, then they can DOS the clipboard itself by, say, writing blank strings to it.

I suppose it might be possible to add some logic to distinguish system events (ctrl+c on a JTextField) from programmer generated events, but that would lead to different parts of the applet having different views of the contents on the clipboard.
Comment 9 eric.thexton 2011-04-20 12:57:56 EDT
ever since i updated to java 6 24 i had this problem.

until i added to my java.policy file the following line: 
permission java.awt.AWTPermission "accessClipboard"

i found that here > http://www.sqlinform.com/forum4/read.php?3,467

good luck
Comment 10 Bug Zapper 2011-05-30 06:56:29 EDT
This message is a reminder that Fedora 13 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 13.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '13'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 13's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 13 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 11 Omair Majid 2011-06-01 14:17:23 EDT
(In reply to comment #7)
> Between the applet and a terminal (gnome-terminal) yes (and vice versa).  This
> did always work, till this 1.6.0.0-50.1.8.7.fc13 release.

By design, copy-paste between the system and an untrusted application is not allowed. The fact that it worked was a security vulnerability that was fixed:
http://hg.openjdk.java.net/jdk6/jdk6/jdk/rev/0933d8b8547a

(In reply to comment #9)
> until i added to my java.policy file the following line: 
> permission java.awt.AWTPermission "accessClipboard"

Any applet (even an invisible one written by by a malicious person trying to steal your information form you) running on any web page can read the contents of your clipboard. I dont know how sensitive or personal the information on your clipboard may be, but I wouldn't risk this.

See also the upstream bug: http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=708

Closing as NOTABUG.

Note You need to log in before you can comment on or make changes to this bug.