Kyle Yuan's Weblog

Wednesday September 01, 2004

Open file:// in java applet

One customer reported 4 months ago that she can't do this in java applet (bug 5005607):

URL url = new URL("file:///path/to/file");
applet.getAppletContext().showDocument(url,"_blank");

After some investigation, I found it is controlled by nsScriptSecurityManager::CheckLoadURIWithPrincipal. If the source scheme is http://, the other protocols it can access are controled by this table. The entry for file:// is "PrefControlled", and the pref entry is "security.checkloaduri" which is originally set to true in all.js. That means opening file:// url from http:// is generally disallowed.

This bug does not appear in mozilla 1.2.1 because there was no this kind of security checking at that time. Our problem is since the java applet is signed, it is supposed to do anything it wants. But unfortunately, mozilla does not know what "signed applet" means yet. So...