java - 自签名 (jdk 7u45) Applet 在 Firefox 和 chrome 中通过 SSL 运行时出现 NullPointerException

Question

我在我的网络应用程序中使用小程序。 我创建自签名小程序 jar 文件并使用 Oracle JDK 1.7.45 编译类。 在客户端，我使用 JRE 1.7.51 并导入证书。 当我在 SSL 协议(protocol)上使用该应用程序时，该小程序在三种浏览器(IE、Mozilla Firefox、Google Chrome)中运行良好。问题是，当我尝试在 chrome 和 Firefox 浏览器中运行 applet，同时在没有 SSL 模式的 http 中使用该应用程序时，出现以下 NullPointerException，但它在 IE 中仍然有效。

java.lang.NullPointerException
    at sun.plugin2.applet.Plugin2ClassLoader.getTrustedCodeSources(Unknown Source)
    at com.sun.deploy.security.CPCallbackHandler$ParentCallback.strategy(Unknown Source)
    at com.sun.deploy.security.CPCallbackHandler$ParentCallback.openClassPathElement(Unknown Source)
    at com.sun.deploy.security.DeployURLClassPath$JarLoader.getJarFile(Unknown Source)
    at com.sun.deploy.security.DeployURLClassPath$JarLoader.access$1000(Unknown Source)
    at com.sun.deploy.security.DeployURLClassPath$JarLoader$1.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at com.sun.deploy.security.DeployURLClassPath$JarLoader.ensureOpen(Unknown Source)
    at com.sun.deploy.security.DeployURLClassPath$JarLoader.<init>(Unknown Source)
    at com.sun.deploy.security.DeployURLClassPath$3.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
    at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
    at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
    at sun.plugin2.applet.Plugin2ClassLoader$1.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Unknown Source)
    at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source)
    at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source)
    at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source)
    at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Unknown Source)
    at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source)
    at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Unknown Source)
    at java.lang.ClassLoader.loadClass(Unknown Source)
    at sun.plugin2.applet.Plugin2ClassLoader.loadCode(Unknown Source)
    at sun.plugin2.applet.Plugin2Manager.initAppletAdapter(Unknown Source)
    at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source) 

在此链接中http://www.oracle.com/technetwork/java/javase/7u45-relnotes-2016950.html ，我看到这 2 个相关的 7u45 已知问题:

Area: Deployment/Plugin

Synopsis: Applet could fail to load by throwing NPE if pack compression is used with deployment caching disabled.

If a JAR file is using pack compression with manifest entries Permissions and Caller-Allowable-Codebase while deployment caching is disabled, then:

• The Permissions manifest entry will be ignored. (This can be seen from the fact that yellow warning is there on security dialog even though the Permissions attribute is there.) This only happens if Caller-Allowable-Codebase attribute is present along with the Permissions attribute.

• The Caller-Allowable-Codebase attribute will cause the applet to fail to load by throwing a java.lang.NullPointerException.

If you want to use pack compression with the Caller-Allowable-Codebase attribute, there are two possible workarounds:

• Enable caching and all issues listed will disappear.

• Do not use the pack property jnlp.packEnabled=true while deploying the applets using Caller-Allowable-Codebase andpremissions property. Instead use the ContentType servlet for serving the pack files.

Area: Deployment/Plugin

Synopsis: Non-JNLP trusted applet fails to load using the file:\ URL. Local trusted applets that do not deploy using a JNLP file will fail to load by throwing a java.lang.NullPointerException. You can work around this issue by using one of the following methods:

• Use a JNLP file to launch the applet.

• Try loading the applet over HTTP or HTTPS.

但我不使用包压缩，而且我使用 JNLP 文件来启动小程序，问题仍然出现。

Answer 1

如果您的 Web 应用程序是通过身份验证步骤访问的，则 Chrome 和 Firefox 的 Java 插件可能无法下载 jar 文件 - 当它们尝试访问小程序的 URL 时，它们很可能会受到您的登录页面。您可以通过 Fiddler 确认这一点。

这个问题在IE中不会出现，因为Java插件能够使用浏览器本身持有的 session ，因此applet加载器能够立即下载jar文件。

如果您遇到这种情况，显而易见的解决方案是允许未经身份验证的访问 jar 文件。如果您使用的是 IIS，则可以通过在 web.config 中添加异常(exception)来完成。