Google App Engine - java.security.AccessControlException?

Question

I am facing this issue whenever i try to access a file which is located in war/WEB_INF folder. I came to know that GAE use jetty and for jetty we need to set some permissions in .policy file but i am unable to locate that file as well. Here is my stack trace: -

java.security.AccessControlException: access denied (java.io.FilePermission /war/WEB_INF/mturktest.properties read)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:374)
at java.security.AccessController.checkPermission(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at com.google.appengine.tools.development.DevAppServerFactory$CustomSecurityManager.checkPermission(DevAppServerFactory.java:283)
at java.lang.SecurityManager.checkRead(SecurityManager.java:871)
at java.io.FileInputStream.<init>(FileInputStream.java:113)
at com.amazonaws.mturk.util.PropertiesClientConfig.<init>(PropertiesClientConfig.java:96)
at com.varundroid.testing.SiteCategory.<init>(SiteCategory.java:51)
at com.varundroid.testing.MTurkProjectServlet.doGet(MTurkProjectServlet.java:12)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1166)
at com.google.appengine.tools.development.HeaderVerificationFilter.doFilter(HeaderVerificationFilter.java:35)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
at com.google.appengine.api.blobstore.dev.ServeBlobFilter.doFilter(ServeBlobFilter.java:60)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
at com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter(TransactionCleanupFilter.java:43)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
at com.google.appengine.tools.development.StaticFileFilter.doFilter(StaticFileFilter.java:125)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
at com.google.appengine.tools.development.BackendServersFilter.doFilter(BackendServersFilter.java:97)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:388)
at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182)
at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:765)
at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:418)
at com.google.appengine.tools.development.DevAppEngineWebAppContext.handle(DevAppEngineWebAppContext.java:94)
at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
at com.google.appengine.tools.development.JettyContainerService$ApiProxyHandler.handle(JettyContainerService.java:370)
at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
at org.mortbay.jetty.Server.handle(Server.java:326)
at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542)
at org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete(HttpConnection.java:923)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:547)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:212)
at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404)
at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:409)
at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:582)

Is there anything extra i need to perform for ex. adding some lines in appengine-web.xml to enable GAE to read this file?

Any help would be really appreciated.

Thanks.

Do you have control over the code that opens the FileInputStream or is it hidden in third party code? — Joachim Isaksson, Sep 09 '12 at 07:56
@JoachimIsaksson Yeah now i have. It was a third party lib called Amazon mturk java sdk. I decompressed the jar file of the SDK to check if something is wrong inside the code. But there is nothing wrong. All that SDK is using normal java.io for reading from file. — Varundroid, Sep 09 '12 at 11:09
I need a File object in order to use with GoogleCredential.Builder().setServiceAccountPrivateKeyFromP12File(xxxx). InputStream doesn't solve my problem. When I run System.out.println(new File("/home/andre/xx-privatekey.p12").exists()) as standalone code, it works well. When I run same code inside Jetty (GAE) server it gives access denied as mentioned above. How can I solve? Where is this policy file? — André Salvati, Jan 25 '13 at 20:53

score 0 · Accepted Answer · edited May 23 '17 at 12:12

The easiest way in GAE to get to the property file, provided that you have access to the code that opens the file, is to just move it to WEB-INF/classes and use getResourceAsStream to get an InputStream to it;

this.getClass().getClassLoader().getResourceAsStream("/mturktest.properties");

There are other options using getRealPath() described here that may give you a correct path for File I/O to work with, but I've never tested personally tested them with GAE so that I know they work.

Google App Engine - java.security.AccessControlException?

1 Answers1