Closed GoogleCodeExporter closed 9 years ago
Original comment by tres.fin...@gmail.com
on 22 Nov 2013 at 1:51
Attachments:
Ok, I've been studying this closely for various clients and I've come across
another scenario:
It is caused by Java appending a 443 to the end of the domain on secure URLs,
which breaks it's codebase checks (the slight mismatch makes it believe it is
hosted by a different website). This is most certainly a bug with Java but I
can't pinpoint why it only happens for some users.
There's two work-arounds for this issue.
1. One is for us to recompile of the plugin using this new attribute:
> Application-Library-Allowable-Codebase *
2. Another is for the web server to be configured to ALWAYS have the website
append ":443" to the end of the hostname for secure URLs. Why this doesn't
happen for other common ports (:80) I'm not sure.
I plan to add the new attribute in 1.8.0 with the hopes that Oracle doesn't
change their mind on allowing it.
-Tres
Original comment by tres.fin...@gmail.com
on 30 Nov 2013 at 8:29
Attachments:
Fixed in 1.8.0 by adding Application-Library-Allowable-Codebase: *.
This allows cross-site scripting, so it may be blocked in future Java versions
without warning from Oracle.
Since printing (generally) has low security risk, I've added a feature that
blocks malicious file extensions when using printToFile().
Closing and marking as fixed. Please reopen if needed.
-Tres
Original comment by tres.fin...@gmail.com
on 5 Dec 2013 at 3:39
Original issue reported on code.google.com by
tres.fin...@gmail.com
on 22 Nov 2013 at 1:49