Signed applet loading signed jar reading file error

Question

I'm working on a game at the moment and have made a JFrame loader which can load the game from the user.home directory, but recently decided I wanted it in a web applet as well.

When I run the JFrame loader it successfully loads the game, checks the file and opens. (both game and JFrame are signed) I can load and invoke the method from the Applet fine using:

m.invoke(null, (Object) new String[]{textPack, font, currVersionStr,saveDir}, null, null, this);

But then the following error occurs when the Applet tries to load it, it manages to load the game fine but when it tries to load the saved options with the code:

 File f = new File(OS.saveDir + OS.fileSeparator + "Options.keys");
    if (!f.exists()) {
        try {
            f.createNewFile();
            saveKeys();
        } catch (IOException ex) {
            Logger.getLogger(Configuration.class.getName()).log(Level.SEVERE, null, ex);
        }

It gives me the following error:

Mar 14, 2013 11:10:21 PM core.GameEngine run SEVERE: null java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Users\Jake.Zombies\Options.keys" "read") at java.security.AccessControlContext.checkPermission(Unknown Source) at java.security.AccessController.checkPermission(Unknown Source) at java.lang.SecurityManager.checkPermission(Unknown Source) at java.lang.SecurityManager.checkRead(Unknown Source) at java.io.File.exists(Unknown Source) at core.Configuration.loadKeys(Configuration.java:123) at core.Configuration.onStartup(Configuration.java:105) at core.GameEngine.run(GameEngine.java:76)

With line if(!f.exists()) being Configuration.java:123

My problem is it loads fine in the JFrame loader (signed) but not the Applet (Signed)

Any help is much appreciated, thanks.

EDIT: The applet loader checks for files, and can download newest ones fine. It's only when I then ask the game that I load, to load files it encounters problems.

Edit 2 (full loading code):

 File folder = new File(saveDir);
        URL u = new URL("jar:" + folder.toURI().toURL() + "Zombies.jar!/");
        URLClassLoader ucl = URLClassLoader.newInstance(new URL[]{u});
        Class c = Class.forName("Visual.GameDisplay", true, ucl);
        Method m = c.getMethod("main", String[].class, String[].class, java.sql.Connection.class, Component.class);
        m.invoke(null, (Object) new String[]{textPack, font, currVersionStr,saveDir}, null, null, this);

Writes by just getting a buffered input stream, then writing it to a bufferedoutputstream.

Answer 1

http://docs.oracle.com/javase/tutorial/deployment/applet/security.html

Applets aren't allowed arbitrary file access.

Actually, there is an exception if loaded from local disk. How was this loaded?

Answer 2

An applet does not allow access to the user file system. You have to save the data back to the server.

Answer 3

It's a really idea to mix trusted and untrusted code. You could be loading anything. A safer way to load the code would be through javax.jnlp, which should be available to applets since 6u10. Note, you should be sure that you don't reference any of the classes before loading the jar has completed, as you wont then be able to use those class names (it doesn't sue separate class loaders).