How to call an applet from Javascript

Question

I have an applet to download some files from a specific folder and delete them, but something is wrong when I call the applet function from my javascript code, when I call this function from init() , it works fine.

My applet code is:

 public class Uploader extends Applet { String serverPath; String clientPath; private JSObject win; @Override public void init() { serverPath = getParameter("serverPath"); clientPath = getParameter("clientPath"); try { win = JSObject.getWindow(this); } catch (JSException e) { log.warning("Can't access JSObject object"); } upload(topic,clientPath); } public void upload(String topic,String clientPath) { log.log(Level.SEVERE, "upload functiond"); DefaultHttpClient client = new DefaultHttpClient(); MultipartEntity form = new MultipartEntity(); log.log(Level.SEVERE, "upload functiond2"); try { File directory = new File(clientPath); log.log(Level.SEVERE, "upload functiond2.2"); File[] files = directory.listFiles(); log.log(Level.SEVERE, "upload functiond2.5"); int i = 0; for (File file : files) { log.log(Level.SEVERE, "upload functiond2.6"); i++; form.addPart("file" + String.valueOf(i), new FileBody(file)); System.out.println("adding file " + String.valueOf(i) + " " + file); log.log(Level.SEVERE, "adding file " + String.valueOf(i) + " " + file); } log.log(Level.SEVERE, "upload functiond3"); form.addPart("topic", new StringBody(topic, Charset.forName("UTF-8"))); form.addPart("action", new StringBody(action, Charset.forName("UTF-8"))); form.addPart("path", new StringBody(serverPath, Charset.forName("UTF-8"))); HttpPost post = new HttpPost(serverPath); .... 

and this is my javascript code:

 document.applet.upload(title,"c:\scan"); 

When I called from javascript only the log printed:

 log.log(Level.SEVERE, "upload functiond2.2"); 

Note that when I call the applet method from init , it works fine.

I port my code to PriviligedAction , but it only goes one step further and freezes

 log.log(Level.SEVERE, "upload functiond2.5"); 

Answer 1

The interaction of Java and JS complicates security. The JRE cannot trust JS, so it decides that the entire "chain of operations" that your code is in is not trusted. There is a way to fix this.

The code must be wrapped in PrivilegedAction and called using one of the AccessController , which doPrivileged(..) . Look at the top of AccessController . (above methods) to see an example of use.