AccessControlException with Transform in Applet (Xalan/JAXP 1.1)

[Roger L. Cauvin]

I get the following exception when I try to apply a transformation in an
applet using JAXP 1.1 (the reference implementation of which uses Xalan):

java.security.AccessControlException: access denied
(java.util.PropertyPermission user.dir read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
at java.lang.System.getProperty(Unknown Source)
at
org.apache.xalan.processor.TransformerFactoryImpl.newTemplates(TransformerFa
ctoryImpl.java:598)
at
org.apache.xalan.processor.TransformerFactoryImpl.newTransformer(Transformer
FactoryImpl.java:550)
at
org.apache.xalan.processor.TransformerFactoryImpl.newTransformer(Transformer
FactoryImpl.java:573)
at
tree.xml.ExtractXMLStringTreeNodeAction.transformXML(ExtractXMLStringTreeNod
eAction.java:64)

My code looks like:

TransformerFactory transformerFactory =
TransformerFactory.newInstance();
Transformer transformer = transformerFactory.newTransformer();
transformer.transform(xmlInputSource, outputResult);

Apparently, Xalan tries to access the user.dir system property, which is not
legal in an applet. Any ideas how to work around this problem?

--
Roger L. Cauvin
rca...@homemail.com
http://www.thegym.net/rcauvin

[Roger L. Cauvin]

For others who run into the same problem, here is how I managed to work
around the problem. First, the exception I described originally does not
occur under the release of JAXP 1.1 or Xalan 2.0. The Xalan 2.0 release
specifically fixed the bug in the TransformerFactoryImpl class that attempts
to access the user.dir system property.

Unfortunately, a different exception still occurs when an applet attempts to
serialize a DOM tree using a transformer:

java.security.AccessControlException: access denied
(java.util.PropertyPermission method read)

at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
at java.lang.System.getProperty(Unknown Source)
at

org.apache.xalan.templates.OutputProperties.loadPropertiesFile(OutputPropert
ies.java:202)
at
org.apache.xalan.templates.OutputProperties.getDefaultMethodProperties(Outpu
tProperties.java:248)
at
org.apache.xalan.templates.OutputProperties.<init>(OutputProperties.java:126
)
at
org.apache.xalan.transformer.TransformerIdentityImpl.<init>(TransformerIdent
ityImpl.java:104)
at
org.apache.xalan.processor.TransformerFactoryImpl.newTransformer(Transformer
FactoryImpl.java:687)
at
tree.xml.ExtractXMLStringTreeNodeAction.transformXML(ExtractXMLStringTreeNod
eAction.java:64)

The problem is in the OutputProperties class. It attempts to access system
properties and fails when an applet executes the code. To remedy this
problem, follow the procedure below:

1. Manually edit the OutputProperties.loadPropertiesFile() source in the
Xalan 2.0 release distribution to catch the AccessControlException for each
of the two calls to System.getProperty().

2. Run jar to replace it in xalan.jar.

In order to set the output properties for use within applets, you'll
probably need to manually edit the output_xml.properties file in the
xalan.jar file. For example, I reset the following properties:

indent=yes (was 'no')
omit-xml-declaration=yes (was 'no')
indent-amount=2 (was '0')

I learned an important lesson from this tedious exercise: avoid accessing
system properties in code that you wish to be useable in applets, or bracket
the offending code with try/catch blocks to handle the applet case.

--
Roger L. Cauvin
rca...@homemail.com
http://www.thegym.net/rcauvin

"Roger L. Cauvin" <rca...@homemail.com> wrote in message
news:97empl$or5uf$1...@ID-20080.news.dfncis.de...