2 ways to get page url in java applets, what's the difference and/or benefits of each?

Question

Hi experts,,,

the two ways that I know to get the page url are: 1.through the applet class: Applet.getDocumentBase()

2.through the netscape javascript library: JSObject.getWindow(this).eval("location.href")

First, what are the differences between those two methods and advantages of each,

Secondly, can users trick the url of those methods in someway? to make the applet think it's embeded in http://www.stackoverflow.com/index.html for example?

Answer 1

If you look at the code for Applet.getDocumentBase() (sun's implementation of AppletStub), you'll see that it is also getting the location using JSObject. But it has a lot of additional code around it, and is guaranteed to work across all browsers and setups. So better use Applet.getDocumentBase()

Answer 2

JSObject is buggy in some browsers (IE and Safari especially). Applet.getDocumentBase() is a lot safer.

Answer 3

The answer is easier than you think.

You should use Applet.getDocumentBase in case the implementation varies between platforms or JVMs, or is altered at a later date. Just because JSObject is the way that Sun's JVM gets this value doesn't mean that, say, IBM's JVM works that way.

Answer 4

Pretty sure users could spoof it:

1. Download your .jar and host on a server controlled by the user
2. Change their etc/hosts file so that stackoverflow.com points to the IP of their server
3. Configure the server to serve requests for stackoverflow.com
4. Visit the page on the server with the applet embedded

And the applet will believe it's on stackoverflow.com. There is probably a simpler way to spoof it though!