Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-6466058

OceanTheme causes swing components to serialize with sun.* classes

    Details

    • Subcomponent:
    • Introduced In Build:
      b04
    • Introduced In Version:
    • Resolved In Build:
      b03
    • CPU:
      x86
    • OS:
      linux
    • Verification:
      Verified

      Backports

        Description

        FULL PRODUCT VERSION :
        java version "1.5.0_08"
        Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_08-b03)
        Java HotSpot(TM) Client VM (build 1.5.0_08-b03, mixed mode, sharing)

        java version "1.6.0-rc"
        Java(TM) SE Runtime Environment (build 1.6.0-rc-b92)
        Java HotSpot(TM) Client VM (build 1.6.0-rc-b92, mixed mode, sharing)

        ADDITIONAL OS VERSION INFORMATION :
        Linux localhost.localdomain 2.6.11-1.1369_FC4 #1 Thu Jun 2 22:55:56 EDT 2005 i686 i686 i386 GNU/Linux

        A DESCRIPTION OF THE PROBLEM :
        When serializing Swing components (tested with JFrame and JPanel) with the Ocean theme, classes from sun.swing.* are serialised. sun.* classes cannot be deserialised. This will cause an AccessControlException in untrusted code.

        Examining the serializer data, the class sun.swing.PrintColorUIResource appears to be present. This class appears in javax.swing.plaf.metal.OceanTheme.CONTROL_TEXT_COLOR and OCEAN_BLACK. Using the -Dswing.metalTheme=steel command line option switches to the Steel theme and prevents the exception. I believe Component.doSwingSerialization should remove PL&F artifacts during serialization.

        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        The program below set a security manager, serialises a JPanel and then desrialises it. Run as:

        java OceanSun

          To run without Ocean (and hence the exception):

        java -Dswing.metalTheme=steel OceanSun


        EXPECTED VERSUS ACTUAL BEHAVIOR :
        EXPECTED -
        The program should run and exit without error.

        ERROR MESSAGES/STACK TRACES THAT OCCUR :
        Exception in thread "main" java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.swing)
                at java.security.AccessControlContext.checkPermission(Unknown Source)
                at java.security.AccessController.checkPermission(Unknown Source)
                at java.lang.SecurityManager.checkPermission(Unknown Source)
                at java.lang.SecurityManager.checkPackageAccess(Unknown Source)
                at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source)
                at java.lang.ClassLoader.loadClass(Unknown Source)
                at java.lang.ClassLoader.loadClassInternal(Unknown Source)
                at java.lang.Class.forName0(Native Method)
                at java.lang.Class.forName(Unknown Source)
                at java.io.ObjectInputStream.resolveClass(Unknown Source)
                at java.io.ObjectInputStream.readNonProxyDesc(Unknown Source)
                at java.io.ObjectInputStream.readClassDesc(Unknown Source)
                at java.io.ObjectInputStream.readOrdinaryObject(Unknown Source)
                at java.io.ObjectInputStream.readObject0(Unknown Source)
                at java.io.ObjectInputStream.defaultReadFields(Unknown Source)
                at java.io.ObjectInputStream.defaultReadObject(Unknown Source)
                at java.awt.Component.readObject(Unknown Source)
                at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
                at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
                at java.lang.reflect.Method.invoke(Unknown Source)
                at java.io.ObjectStreamClass.invokeReadObject(Unknown Source)
                at java.io.ObjectInputStream.readSerialData(Unknown Source)
                at java.io.ObjectInputStream.readOrdinaryObject(Unknown Source)
                at java.io.ObjectInputStream.readObject0(Unknown Source)
                at java.io.ObjectInputStream.readObject(Unknown Source)
                at OceanSun.main(OceanSun.java:15)


        REPRODUCIBILITY :
        This bug can be reproduced always.

        ---------- BEGIN SOURCE ----------
        import java.io.*;
        import javax.swing.*;

        class OceanSun {
            public static void main(String[] args) throws Exception {
                System.setSecurityManager(new SecurityManager());
                ByteArrayOutputStream byteOut = new ByteArrayOutputStream();
                ObjectOutputStream out = new ObjectOutputStream(byteOut);
                JPanel frame = new JPanel();
                out.writeObject(frame);
                out.close();
                ObjectInputStream in = new ObjectInputStream(
                    new ByteArrayInputStream(byteOut.toByteArray())
                );
                JPanel readFrame = (JPanel)in.readObject();
            }
        }

        ---------- END SOURCE ----------

        CUSTOMER SUBMITTED WORKAROUND :
        Don't use Ocean when serializing components. It may be possible to overwrite the relevant Color properties on the Component.

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  shickeysunw Shannon Hickey (Inactive)
                  Reporter:
                  ndcosta Nelson Dcosta (Inactive)
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  0 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved:
                    Imported:
                    Indexed: