Java 7 update 45 broke my Web Start SWT application

Question

I maintain an Eclipse RCP application launched with WebStart. Java 7 u45 made some security changes, and now my application crashes on startup.

I\'ve added to the manifes

Answer 1

I have experienced the same issue and managed to solve it by doing following:

In all manifest files (for each JAR in your RCP project) add these attributes:

Application-Name: My App Name
Permissions: all-permissions
Codebase: *
Application-Library-Allowable-Codebase: *
Caller-Allowable-Codebase: *
Trusted-Library: true

Second part of solution is to make jnlp properties secure by adding jnlp prefix. I have found solution here. You need to do this for framework properties (osgi, eclipse..) and for your properties E.g. instead of:

<property name="eclipse.product" value="com.amdosoft.oct.ui.product"/>
<property name="osgi.instance.area" value="@user.home/Application Data/myApp"/>
<property name="osgi.configuration.area" value="@user.home/Application Data/myApp"/>
<property name="my.App.property" value="someValue"/>

use

<property name="jnlp.eclipse.product" value="com.amdosoft.oct.ui.product"/>
<property name="jnlp.osgi.instance.area" value="@user.home/Application Data/myApp"/>
<property name="jnlp.osgi.configuration.area" value="@user.home/Application Data/myApp"/>
<property name="jnlp.my.App.property" value="someValue"/>

Download eclipse launcher with sources from here

In web start launcher you need to change back property names to old values (without jnlp prefix). You can do that by adding this part of source into main method of WebStartLauncher class.

Properties properties = System.getProperties();
// copy properties to avoid ConcurrentModificationException
Properties copiedProperties = new Properties();
copiedProperties.putAll(properties);
Set<Object> keys = copiedProperties.keySet();
for (Object key : keys) {
    if (key instanceof String) {
        String keyString = (String) key;
        if (keyString.startsWith("jnlp.")) {
            // re set all properties starting with the jnlp-prefix 
            // and set them without the prefix
            String property = System.getProperty(keyString);
            String replacedKeyString = keyString.replaceFirst("jnlp.", "");

            System.setProperty(replacedKeyString, property);
        }
    }
}

Export you new launcher as runnable JAR and put it in the same directory where your JNLP file is located.

Edit JNLP file by adding this line:

<jar href="myAppLauncher.jar"/>

inside tag and edit your application-desc tag like this:

<application-desc main-class="org.eclipse.equinox.launcher.WebStartMain">
  </application-desc>

Answer 2

We've had multiple JNLP files up until now, and it seemed to work.

We install our app on customer internal networks, so we can't set a codebase other than * without resigning the entire set of jars for each customer.

Answer 3

When 7u25 came out, my application would crash with a classloader issue (sometimes, it was weird). The fix involved nixing my "Components.jnlp" deployment strategy. I had my library files in a separate .jnlp (Components.jnlp, as per a solution I read online back in 2010) and my main .jnlp (launch.jnlp) would load that .jnlp.

Now, it seems the Netbeans-generated .jnlp is sufficient and I no longer need any separate .jnlp for library components. I'm not sure if eclipse gives you an auto-generated .jnlp or not.

In the end, changing the launch.jnlp involved me having to give my clients a new installer that would load the new .jnlp onto their computers. It sucked but it worked.

Also, I'm not sure what Codebase: * is supposed to do. Why don't you just put your actual codebase in there?

If you did not deploy your app with that approach then this answer probably won't help. Might help somebody.