Java-Gaming.org    
Featured games (81)
games approved by the League of Dukes
Games in Showcase (499)
Games in Android Showcase (118)
games submitted by our members
Games in WIP (568)
games currently in development
News: Read the Java Gaming Resources, or peek at the official Java tutorials
 
    Home     Help   Search   Login   Register   
Pages: [1]
  ignore  |  Print  
  Is it possible to get text out of an unsigned applet?  (Read 1863 times)
0 Members and 1 Guest are viewing this topic.
Offline ShannonSmith
« Posted 2011-07-17 23:52:10 »

Is there any way of getting text onto the system clipboard from an unsigned applet (ctrl+c doesn't even work).
Offline CommanderKeith
« Reply #1 - Posted 2011-07-18 01:15:13 »


No there isn't, you need full permissions. I've looked into it in detail. Flash and javascript also block it out too.

Offline JL235

JGO Coder


Medals: 10



« Reply #2 - Posted 2011-07-18 01:26:11 »


No there isn't, you need full permissions. I've looked into it in detail. Flash and javascript also block it out too.
Not entirely true, there is a solution here (although I've not tried it). They say that the user needs to initiate the process, by clicking on top of an invisible Flash object.

You can communicate with Applets via JavaScript, so you could get your text out, and then use the interface they provide to set it up to copy this to the clipboard when the user clicks.

Games published by our own members! Check 'em out!
Legends of Yore - The Casual Retro Roguelike
Offline CommanderKeith
« Reply #3 - Posted 2011-07-18 13:00:15 »

Interesting. At first it seemed strange since clipboard access is seen as a security concern. But then after trying it, i see that it only supports copy operations to the clipboard, not paste. So information can't be retrieved which is fine and logical.

I wonder why adobe made it possible for such a back-door hack like that to work, rather than support it out of the box. Odd.

Offline philfrei
« Reply #4 - Posted 2011-07-18 19:14:50 »

It IS possible to get to the clipboard via JNLP, without signing.

http://download.oracle.com/javase/tutorial/deployment/doingMoreWithRIA/jnlpAPI.html

I haven't tried it yet. But I've had success getting FileOpenService and FileSaveService working. Making a proper JNLP file was a chore, but it's not that bad, once one has done it right the first time.

Here's a more direct link:
http://download.oracle.com/javase/7/docs/jre/api/javaws/jnlp/javax/jnlp/ClipboardService.html
Quote
ClipboardService provides methods for accessing the shared system-wide clipboard, even for applications that are running in the untrusted execution environment. Implementors should warn the user of the potential security risk of letting an untrusted application have access to potentially confidential information stored in the clipboard, or overwriting the contents of the clipboard.

"Greetings my friends! We are all interested in the future, for that is where you and I are going to spend the rest of our lives!" -- The Amazing Criswell
Offline Dx4

Junior Member


Medals: 5



« Reply #5 - Posted 2011-07-19 14:49:19 »

here

1  
2  
3  
4  
5  
6  
7  
8  
9  
10  
11  
12  
13  
14  
15  
16  
17  
18  
19  
20  
21  
22  
function setClipboardText(text) {
    if (window.clipboardData) {
        window.clipboardData.setData('text', text);
   } else {
      var flashId = 'flashId-HKxmj5';
   
      /* Replace this with your clipboard.swf location */
      var clipboardSWF = 'http://appengine.bravo9.com/copy-into-clipboard/clipboard.swf';
   
      if(!document.getElementById(flashId)) {
         var div = document.createElement('div');
         div.id = flashId;
         document.body.appendChild(div);
      }
      document.getElementById(flashId).innerHTML = '';
      var content = '<embed src="' +
         clipboardSWF +
         '" FlashVars="clipboard=' + encodeURIComponent(text) +
         '" width="0" height="0" type="application/x-shockwave-flash"></embed>';
      document.getElementById(flashId).innerHTML = content;
   }
}
from: http://stackoverflow.com/questions/127040/copy-put-text-on-the-clipboard-with-firefox-safari-and-chrome

then execute:

1  
jsObject.eval("setClipboardText(\"" + text + "\");");


to run it
Offline CommanderKeith
« Reply #6 - Posted 2011-07-20 07:32:57 »

It IS possible to get to the clipboard via JNLP, without signing.

http://download.oracle.com/javase/tutorial/deployment/doingMoreWithRIA/jnlpAPI.html

I haven't tried it yet. But I've had success getting FileOpenService and FileSaveService working. Making a proper JNLP file was a chore, but it's not that bad, once one has done it right the first time.

Here's a more direct link:
http://download.oracle.com/javase/7/docs/jre/api/javaws/jnlp/javax/jnlp/ClipboardService.html

Quote
ClipboardService provides methods for accessing the shared system-wide clipboard, even for applications that are running in the untrusted execution environment. Implementors should warn the user of the potential security risk of letting an untrusted application have access to potentially confidential information stored in the clipboard, or overwriting the contents of the clipboard.

That is so strange, two different ways to access the clipboard in java, but one has stricter security access... weird!

Offline h3ckboy

JGO Coder


Medals: 5



« Reply #7 - Posted 2011-07-20 21:40:46 »

This is just speculating, but maybe it has to do with HOW it accesses the clipboard, because maybe one does it a different way, in by doing that does things that are security risk. just thinking speculating, that could be completely wrong Smiley
Offline kappa
« League of Dukes »

JGO Kernel


Medals: 77
Projects: 15


★★★★★


« Reply #8 - Posted 2011-07-21 11:19:03 »

this recent blog post might clarify the situation a little http://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
Offline Cero
« Reply #9 - Posted 2011-07-21 12:52:54 »

so eeeh, how exactly is this a security issue (especially all of the sudden) ?

is someone gonna, like, flood your clipboard ?

or paste your passwords from it ? (if they were in the clipboard to begin with, its obviously your own fault =D)

Pages: [1]
  ignore  |  Print  
 
 
You cannot reply to this message, because it is very, very old.

 

Add your game by posting it in the WIP section,
or publish it in Showcase.

The first screenshot will be displayed as a thumbnail.

Pippogeek (39 views)
2014-09-24 16:13:29

Pippogeek (30 views)
2014-09-24 16:12:22

Pippogeek (20 views)
2014-09-24 16:12:06

Grunnt (46 views)
2014-09-23 14:38:19

radar3301 (28 views)
2014-09-21 23:33:17

BurntPizza (64 views)
2014-09-21 02:42:18

BurntPizza (36 views)
2014-09-21 01:30:30

moogie (42 views)
2014-09-21 00:26:15

UprightPath (52 views)
2014-09-20 20:14:06

BurntPizza (54 views)
2014-09-19 03:14:18
List of Learning Resources
by Longor1996
2014-08-16 10:40:00

List of Learning Resources
by SilverTiger
2014-08-05 19:33:27

Resources for WIP games
by CogWheelz
2014-08-01 16:20:17

Resources for WIP games
by CogWheelz
2014-08-01 16:19:50

List of Learning Resources
by SilverTiger
2014-07-31 16:29:50

List of Learning Resources
by SilverTiger
2014-07-31 16:26:06

List of Learning Resources
by SilverTiger
2014-07-31 11:54:12

HotSpot Options
by dleskov
2014-07-08 01:59:08
java-gaming.org is not responsible for the content posted by its members, including references to external websites, and other references that may or may not have a relation with our primarily gaming and game production oriented community. inquiries and complaints can be sent via email to the info‑account of the company managing the website of java‑gaming.org
Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines | Managed by Enhanced Four Valid XHTML 1.0! Valid CSS!