the interwebs accesses your system !
Monday, 12. January 2009, 18:38:25
Ever wonder how you could have system access, file IO or other capabilities from a html page hosted elsewhere?
Well, in Opera and Mozilla, you can do it with Java, like...
Open it and add the following rule:
That way java will have permission to do system call, File IO, etc. However, you're enabling permissions with a sledge hammer this way, but it's just for the sake of testing. Still, you should have a good read of java security policies, if you want to make this widely available.
http://java.sun.com/j2se/1.3/docs/guide/security/PolicyFiles.html
You have the entire java API available.
This should work
If you're having problems, analyse what is displayed on the Java console (Tools>Advanced>Java console).
Beware, others can eavesdrop scripts on your browser, but if you're coding for yourself, then you're fairly safe.
Note: don't try to fool users into changing their policy file for bad reasons. It's not worth it.
Happy development
Well, in Opera and Mozilla, you can do it with Java, like...
<script type="text/javascript">
java.lang.Runtime.getRuntime().exec("command arg1 arg2");
</script>and that command should execute just fine. But first you need to give Java permissions to execute that, so go to Opera's installation folder and locate the classes\opera.policy file.Open it and add the following rule:
grant codeBase "http://mytrustedserver/-" {
permission java.security.AllPermission;
};where mytrustedserver is the name of your server. "file://-" is also allowed.That way java will have permission to do system call, File IO, etc. However, you're enabling permissions with a sledge hammer this way, but it's just for the sake of testing. Still, you should have a good read of java security policies, if you want to make this widely available.
http://java.sun.com/j2se/1.3/docs/guide/security/PolicyFiles.html
You have the entire java API available.
This should work
var file = navigator.platform.indexOf("Win")>=0 ? "c:\\file.html" : "~/file.html";
var output = new java.io.PrintStream(new java.io.FileOutputStream(new java.io.File(file)));
output.print("<h1>hello world</h1>");
output.close();
java.lang.Runtime.getRuntime().exec("opera "+file);
If you're having problems, analyse what is displayed on the Java console (Tools>Advanced>Java console).
Beware, others can eavesdrop scripts on your browser, but if you're coding for yourself, then you're fairly safe.
Note: don't try to fool users into changing their policy file for bad reasons. It's not worth it.
Happy development




Eam0n # 16. September 2009, 18:48
xErath # 16. September 2009, 21:01
Originally posted by Eam0n:
The permissions are given to all code at http://mytrustedserver/* meaning that that server can send some javascript to your browser that can use java benefiting from those permissions. So if you enable the permission "java.security.AllPermission", the webpage can have full system access.
Originally posted by Eam0n:
That's quite complex, but I think your best option would be a unite service, considering it can do file io and cross domain xhr.