LiveConnect calls are blocked on 7u45 since Java 7u51 became available

Question

I have a page with a Java applet that has the following JavaScript code which makes a LiveConnect call when the window is closing to perform some clean up tasks:

window.onbeforeunload = function(e) {
    var result = document.OutApplet.closeCheck();

Up until yesterday this was working as expected and performed the clean up tasks within the applet.

Now that Java 7u51 is available I have accessed this applet today and selected 'Later' when prompted to updated to the latest version of Java. Now when I close the window I get a JavaScript error:

Object doesn't support property or method 'closeCheck'

Just to clarify this is with Java 7u45 installed.

Is this expected behaviour or is there anything I can do to make it still work on 7u45? I can't find any mention of this in the release notes and prior to 7u51 our live connect call would still work without being on the latest security baseline.

Update

The above was with my Java security set as High.

I have changed it to Medium and repeated the above. I now get a message asking if I want to allow or block the LiveConnect call.

Allow LiveConnect prompt

It seems there is now an undocumented (as far as I can find) requirement that LiveConnect will only work if you are on the security baseline (7u51).

Note the LiveConnect call to the applet works without any changes to the applet once I've updated to 7u51

I've just found this post from someone having a similar problem: https://community.oracle.com/thread/2620141 — Chris R, Jan 15 '14 at 12:17

score 6 · Accepted Answer · edited Jan 16 '14 at 09:32

6

This is a known Java bug affecting all version from 7u25 to 7u45:

http://bugs.sun.com/view_bug.do?bug_id=8027405

Only solution is to upgrade to ~~7u45~~ 7u51 or set the java security slider to 'Medium'.

[Edit] corrected fix version according to bug report

edited Jan 16 '14 at 09:32

Cerber

2,889
4
27
43

answered Jan 15 '14 at 16:44

Dave8304

78
2

That would explain it then. Doesn't really help though as still forces all our users to update to 7u51 now that is the baseline. – Chris R Jan 15 '14 at 16:52
1

"Only solution is to upgrade to 7u45". I think you mean upgrade to 7u51. – Chris R Jan 16 '14 at 09:09
We did experience the issue with 7u45 so you must be right @chrisr. In fact the bug report clearly states that this will be fixed in 7u51 – Cerber Jan 16 '14 at 09:33
yeah sorry - meant 7u51! – Dave8304 Jan 16 '14 at 12:42

score 1 · Answer 2 · answered Jan 15 '14 at 20:22

As to why this recently (yesterday) started failing was because the baseline has been updated https://javadl-esd-secure.oracle.com/update/baseline.version, now if you edit C:\Users\username\AppData\LocalLow\Sun\Java\Deployment\security\baseline.versions and change the 1.7.0_51 to 1.7.0_45 and save the file, it should start working again(but will eventually be updated probably after some arbitrary time).

score 1 · Answer 3 · answered Feb 14 '14 at 05:34

1

1) Close all browsers and programs

2) In the windows explorer, go to %localappdata%low\Sun\Java\Deployment

3) Open the file named “deployment.properties”

4) Add in the below line at the end of this file

                 deployment.expiration.check.enabled=false

5) Save and close the file

answered Feb 14 '14 at 05:34

Friend

11
1

This may work (I haven't tried) but making this change on every computer used to access the applet is no less effort than just updating them all to Java 7u51. – Chris R Feb 14 '14 at 14:59

score 0 · Answer 4 · answered Jan 15 '14 at 13:32

0

Same problem here.

Oracle did warn about new mandatory (see below) options back in september. We implemented and delivered them in the end of last year but today they do not seem to work ...

https://blogs.oracle.com/java-platform-group/entry/new_security_requirements_for_rias

http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/manifest.html

answered Jan 15 '14 at 13:32

Cerber

2,889
4
27
43

I'm not sure that's related. We implemented those too and our applet still runs fine. The issue for us is after it's running and we try to make the LiveConnect call from JS. – Chris R Jan 15 '14 at 15:34
1

@ChrisR have you looked to [Caller-Allowable-Codebase Attribute](http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/manifest.html#caller_allowable) which controls who is allowed to use LiveConnect – Cerber Jan 15 '14 at 16:06
1

Yes we've had that attribute in from when we first saw the blog post you linked to a few months ago. I've updated my answer above to say that our applet works unchanged on 7u51. Given it also used to work as it is on 7u45 until today the only thing I can think that's change is the security baseline, hence my assumption that this now only works if you are at the security baseline. – Chris R Jan 15 '14 at 16:50

score 0 · Answer 5 · answered Jan 27 '14 at 13:36

Another solution if you can't upgrade you JRE (stuck between 1.7.0_25 and 1.7.0_45) :

open the Java Control Panel of the 1.7 JRE (javacpl.exe)
go to the advanced tab
uncheck the following "Java Plug-in" option : 'Enable the next-generation Java Plug-in'

LiveConnect calls are blocked on 7u45 since Java 7u51 became available

5 Answers5