Re: Changing contents of signed Jar ?
Chris Uppal wrote:
I'm not absolutely sure of all that, mind, but it's what the JAR spec and
security architecture document seem to be saying. I'd welcome correction.
A couple points worth noting: The JNLP spec requires that all jars are
signed with the same certificate. ClassLoader does not allow code signed
with the different certificates into the same actual package.
Most of the security documentation is hideously out of date. According
to the blogs, Sun now has someone working full time on code security, so
they might get better.
That raises an interesting question: are resources in a signed JAR checked
before being opened ? I can't find an answer, but I suspect it's no[*]. If
not, then it raises the interesting possibility that an applet or JWS app
supplied and signed by -- say -- the Department of the Environment, could be
hacked to display, um, inappropriate imagery. Again, I'd welcome correction if
I'm missing something, or just plain wrong.
Certainly not (trivially) with JWS. Non-JSW applets, I don't know. I
would strongly suggest not signing any code (you want something
malicious appearing to be authorised by yourself or your employer??).
And don't accept it either.
Tom Hawtin
--
Unemployed English Java programmer
http://jroller.com/page/tackline/