00000004.htm
来自「水木清华BBS」· HTM 代码 · 共 264 行 · 第 1/2 页
HTM
264 行
You might wonder, what does the HTML tag look like, for a signed archive loaded by a plugin? <BR> The HTML is complicated, but, you don't need to write this HTML by hand. When you <BR> downloaded the Java Plug-In, you also could download a tool called the Java Plug-In HTML <BR> Converter. It's very easy to run. Once you've installed it, go to the directory named <BR> HTML_Converter and invoke the simple GUI tool: <BR> <BR> % HTMLConverter & <BR> <BR> Type in the name of the HTML file you need to convert so that it can be loaded by the Plug-In, <BR> and click on the "Convert" button. <BR> <BR> That's all there is to it. For more details on the object HTML tag, see the Java Plug-in HTML <BR> Specification. <BR> <BR> <BR> <BR> Running signed applets with appletviewer <BR> <BR> 1.Step 1 - Get the latest version of JDK 1.1.x <BR> <BR> To follow this example, you'll need to download a copy of JDK 1.1.x. <BR> <BR> Once you've downloaded JDK 1.1.x and installed the software on your client, we're ready to <BR> go. Make sure that the JDK tools are accessible from your search path. We'll need to use <BR> these tools: <BR> <BR> javakey, the tool for generating keys and signing archives <BR> jar, the tool for creating an archive <BR> appletviewer, a stripped-down browser for viewing the applet <BR> <BR> 2.Step 2 - Observe the restrictions placed on applets by default <BR> <BR> Downloaded applets are prevented from writing files to your hard disk. <BR> <BR> Here's the source code for an applet that wants to do just that. It tries to write a file named <BR> /tmp/foo (or a file named "tmpfoo" if you're on a Windows system.) This is not a malicious <BR> applet, but it is trying to do something that the Java Applet Security Manager prevents it <BR> from doing. <BR> <BR> You can see what happens when you try to run this applet by typing this command in a shell <BR> window (or in an MS-DOS prompt window:) <BR> <BR> % appletviewer <A HREF="http://java.sun.com/security/signExample/writeFile.html">http://java.sun.com/security/signExample/writeFile.html</A> <BR> <BR> You should see that the system throws a security exception. This is a good thing, and the <BR> expected behavior. A security exception doesn't mean that a security violation occurred - it <BR> means exactly the opposite. It means that the system caught the applet trying to escape the <BR> restrictions of the applet sandbox. To alert you to that fact, the system threw an exception. <BR> This is programmer terminology for "the system set off a warning bell." When you see a <BR> security exception on a Java system, you know that the system prevented the code from <BR> violating security. <BR> <BR> 3.Step 3 - Set up your system to accept code signed by Duke <BR> <BR> It turns out that Duke (our mascot) signed this applet and stored it in an archive named <BR> signedWriteFile.jar. If you get a copy of Duke's certificate, import it into your system's <BR> identity database and declare Duke to be a trusted entity, then you'll allow any applet signed <BR> by Duke to have full authority on your system. <BR> <BR> Here's the steps you need to take to accomplish that. <BR> <BR> 1.Get a copy of Duke's certificate and store it in a file named Duke.x509 <BR> <BR> 2.Create the identity "Duke" in your JDK 1.1 identity database. By passing the <BR> parameter "true", you're saying that you want Duke to be a trusted identity. <BR> <BR> % javakey -c Duke true <BR> <BR> <BR> 3.Import Duke's certificate into your identity database, assuming you have a copy of <BR> Duke's certifiate in the file named Duke.x509. Associate that certificate with the <BR> identity "Duke" by using that nickname as the first argument to the javakey <BR> command. <BR> <BR> % javakey -ic Duke Duke.x509 <BR> <BR> <BR> 4.Run the applet signed by Duke <BR> <BR> Now go ahead and run the applet signed by Duke. You'll notice that it can now create and <BR> write a file on your local filesystem. <BR> <BR> % appletviewer <A HREF="http://java.sun.com/security/signExample/signedWriteFile.html">http://java.sun.com/security/signExample/signedWriteFile.html</A> <BR> <BR> You might wonder, what does the HTML tag look like, for a signed archive? <BR> <BR> <BR> <applet code=writeFile.class archive="signedWriteFile.jar" width=500 height=50> <BR> </applet> <BR> <BR> That's all there is to it. You simply tell the browser the name of the archive, using the <BR> archive= attribute. For more details on the applet HTML tag, see the JAR Guide. <BR> <BR> 5.Do it yourself <BR> <BR> Here's a script that encapsulates all the steps you need to take. Refer to it as an example, as <BR> you experiment with the new features of JDK 1.1.x. <BR> <BR> doit: a script that creates a Duke identity, keys, certificate, then creates an archive and signs <BR> it. It prints out some diagnostic information, such as the contents of the signed archive, and <BR> the contents of the identity database. <BR> <BR> Here's links to all the files used in this example. <BR> writeFile.html and writeFile.java <BR> Duke.x509 certificate <BR> cert_directive_Duke (template for generating a certificate) <BR> sign_directive_Duke (template for signing an archive) <BR> signedWriteFile.html and signedWriteFile.jar <BR> <BR> For more information, refer to the documentation on our main security page, <BR> <A HREF="http://java.sun.com/security.">http://java.sun.com/security.</A> In particular you might be interested in a brief document <BR> named Using Javakey. <BR> <BR> <BR>【 在 nuaawlp (远方之恋) 的大作中提到: 】 <BR>∶<I> 在发行Java Applet文件时,为了扩展Applet对客户端访问的权限,在服务器 </I><BR>∶<I> 端将所有class文件打包成JAR文档并对它进行了数字签名,那么客户端的浏览器 </I><BR>∶<I> 如何利用公开密匙对该Applet进行安全审查呢? </I><BR>∶<I> 非常感谢! </I><BR> <BR> <BR>-- <BR>※ 来源:·BBS 水木清华站 bbs.net.tsinghua.edu.cn·[FROM: cascade.cs.ubc.] <BR><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER></BODY></HTML>
⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?