LiveConnect calls are blocked on 7u45 since Java 7u51 became available

Question

I have a page with a Java applet that has the following JavaScript code which makes a LiveConnect call when the window is closing to perform some clean up tasks:

window.onbeforeunload = function(e) {
    var result = document.OutApplet.closeCheck();

Up until yesterday this was working as expected and performed the clean up tasks within the applet.

Now that Java 7u51 is available I have accessed this applet today and selected 'Later' when prompted to updated to the latest version of Java. Now when I close the window I get a JavaScript error:

Object doesn't support property or method 'closeCheck'

Just to clarify this is with Java 7u45 installed.

Is this expected behaviour or is there anything I can do to make it still work on 7u45? I can't find any mention of this in the release notes and prior to 7u51 our live connect call would still work without being on the latest security baseline.

Update

The above was with my Java security set as High.

I have changed it to Medium and repeated the above. I now get a message asking if I want to allow or block the LiveConnect call.

It seems there is now an undocumented (as far as I can find) requirement that LiveConnect will only work if you are on the security baseline (7u51).

Note the LiveConnect call to the applet works without any changes to the applet once I've updated to 7u51

Zoril

I've just found this post from someone having a similar problem: community.oracle.com/thread/2620141 – Zoril

Answer 1

This is a known Java bug affecting all version from 7u25 to 7u45:

https://bugs.java.com/bugdatabase/view_bug?bug_id=8027405

Only solution is to upgrade to 7u45 7u51 or set the java security slider to 'Medium'.

[Edit] corrected fix version according to bug report

Assault

That would explain it then. Doesn't really help though as still forces all our users to update to 7u51 now that is the baseline. – Zoril

"Only solution is to upgrade to 7u45". I think you mean upgrade to 7u51. – Zoril

We did experience the issue with 7u45 so you must be right @chrisr. In fact the bug report clearly states that this will be fixed in 7u51 – Lelahleland

yeah sorry - meant 7u51! – Assault

Answer 2

As to why this recently (yesterday) started failing was because the baseline has been updated https://javadl-esd-secure.oracle.com/update/baseline.version, now if you edit C:\Users\username\AppData\LocalLow\Sun\Java\Deployment\security\baseline.versions and change the 1.7.0_51 to 1.7.0_45 and save the file, it should start working again(but will eventually be updated probably after some arbitrary time).

Pitarys

Answer 3

1) Close all browsers and programs

2) In the windows explorer, go to %localappdata%low\Sun\Java\Deployment

3) Open the file named “deployment.properties”

4) Add in the below line at the end of this file

                 deployment.expiration.check.enabled=false

5) Save and close the file

Weapon

This may work (I haven't tried) but making this change on every computer used to access the applet is no less effort than just updating them all to Java 7u51. – Zoril

Answer 4

Same problem here.

Oracle did warn about new mandatory (see below) options back in september. We implemented and delivered them in the end of last year but today they do not seem to work ...

https://blogs.oracle.com/java-platform-group/entry/new_security_requirements_for_rias

http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/manifest.html

Lelahleland

I'm not sure that's related. We implemented those too and our applet still runs fine. The issue for us is after it's running and we try to make the LiveConnect call from JS. – Zoril

@ChrisR have you looked to Caller-Allowable-Codebase Attribute which controls who is allowed to use LiveConnect – Lelahleland

Yes we've had that attribute in from when we first saw the blog post you linked to a few months ago. I've updated my answer above to say that our applet works unchanged on 7u51. Given it also used to work as it is on 7u45 until today the only thing I can think that's change is the security baseline, hence my assumption that this now only works if you are at the security baseline. – Zoril

Answer 5

Another solution if you can't upgrade you JRE (stuck between 1.7.0_25 and 1.7.0_45) :

• open the Java Control Panel of the 1.7 JRE (javacpl.exe)
• go to the advanced tab
• uncheck the following "Java Plug-in" option : 'Enable the next-generation Java Plug-in'

Leaper