Red Hat Bugzilla – Bug 689157
Copy/paste from/to Java applets does not work anymore
Last modified: 2011-06-01 14:17:23 EDT
Description of problem:
Since the upgrade of java-1.6.0-openjdk (and the plugin) to version 220.127.116.11-18.104.22.168.fc13 copy/paste from/to Java applets doe snot work anymore.
Version-Release number of selected component (if applicable):
See for example http://www.finnzymes.com/tm_determination.html (but the problem appears in all Java applets I tried) and try to copy/paste text from/to the first input field in the applet. This does not work with version 22.214.171.124-126.96.36.199.fc13, but it does work with version 188.8.131.52-37.b17.fc13. I downgraded java-1.6.0-openjdk and java-1.6.0-openjdk-plugin to the latter version now it's working again.
Can you please test with 184.108.40.206-220.127.116.11.fc13? You can grab the rpms from: http://koji.fedoraproject.org/koji/buildinfo?buildID=226683
Yes, with version 18.104.22.168-22.214.171.124.fc13 it works ok.
Sounds like the fix  for CVE-2010-4465 removed clipboard access for untrusted applets. I will look into updating the plugin to work with the fix.
Note that another problem I have with 126.96.36.199-188.8.131.52.fc13 (a problem that not appeared in 184.108.40.206-37.b17.fc13) is not solved in 220.127.116.11-18.104.22.168.fc13: when the Java applet opens a new window, I can't close that new window with window close button. Should I open a new bug for this?
(In reply to comment #3)
> Sounds like the fix  for CVE-2010-4465 removed clipboard access for
> untrusted applets. I will look into updating the plugin to work with the fix.
Scratch that. I thought I could reproduce this, but I cant any more. I tested the applet with 1.8.7, 1.9.7 and IcedTea-Web and I can copy/paste text inside the applet.
Are you having issues in copying and pasting text between the applet and the rest of the system? If so, I am afraid there is not much I can do - that's pretty much by design. An untrusted applet can not access (read/write) the system clipboard.
(In reply to comment #4)
> Note that another problem I have with 22.214.171.124-126.96.36.199.fc13 (a problem that not
> appeared in 188.8.131.52-37.b17.fc13) is not solved in 184.108.40.206-220.127.116.11.fc13: when
> the Java applet opens a new window, I can't close that new window with window
> close button. Should I open a new bug for this?
(In reply to comment #5)
> Are you having issues in copying and pasting text between the applet and the
> rest of the system? If so, I am afraid there is not much I can do - that's
> pretty much by design. An untrusted applet can not access (read/write) the
> system clipboard.
Between the applet and a terminal (gnome-terminal) yes (and vice versa). This did always work, till this 18.104.22.168-22.214.171.124.fc13 release.
Untrusted code (like the applet in the example you posted) is not allowed to access the clipboard. From looking at the code, this looks like a very deliberate security decision.
If untrusted applets are allowed to read the system clipboard (which would allow copy/paste to other applications) then the applets could read potentially sensitive information in the clipboard. If applets are allowed to write to the clipboard, then they can DOS the clipboard itself by, say, writing blank strings to it.
I suppose it might be possible to add some logic to distinguish system events (ctrl+c on a JTextField) from programmer generated events, but that would lead to different parts of the applet having different views of the contents on the clipboard.
ever since i updated to java 6 24 i had this problem.
until i added to my java.policy file the following line:
permission java.awt.AWTPermission "accessClipboard"
i found that here > http://www.sqlinform.com/forum4/read.php?3,467
This message is a reminder that Fedora 13 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 13. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora
'version' of '13'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version prior to Fedora 13's end of life.
Bug Reporter: Thank you for reporting this issue and we are sorry that
we may not be able to fix it before Fedora 13 is end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora please change the 'version' of this
bug to the applicable version. If you are unable to change the version,
please add a comment here and someone will do it for you.
Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.
The process we are following is described here:
(In reply to comment #7)
> Between the applet and a terminal (gnome-terminal) yes (and vice versa). This
> did always work, till this 126.96.36.199-188.8.131.52.fc13 release.
By design, copy-paste between the system and an untrusted application is not allowed. The fact that it worked was a security vulnerability that was fixed:
(In reply to comment #9)
> until i added to my java.policy file the following line:
> permission java.awt.AWTPermission "accessClipboard"
Any applet (even an invisible one written by by a malicious person trying to steal your information form you) running on any web page can read the contents of your clipboard. I dont know how sensitive or personal the information on your clipboard may be, but I wouldn't risk this.
See also the upstream bug: http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=708
Closing as NOTABUG.