Why does Java tell me my applet contains both signed and unsigned code?

Question

My signed Java applet has been running fine until Java update 19. Now some but not all of our users on Java Update 19 report a java security message stating that our applet contains both signed and unsigned code.

The process for creating our applet is as follows:

1: Clean and Build the applet project in Netbeans IDE. 2: Open the Applet jar file in WinRAR and add the required mysql JDBC driver .class files to the jar file. 3: Sign the applet jar file.

Can someone please tell me how to determine what code is signed and what code is not signed in our applet? Is there a better way to include the mysql JDBC driver jar file in our applet other than copying the jar file contents into our applet jar file?

Thanks

Answer 1

Mixing trusted and untrusted code together is a vulnerability that has been fixed in the 6u19 (the current CPU/SSR release at the time of writing). See the docs. Blocking the mix or using a debugger should show where the problem is.

Answer 2

Some things to try:

• Go to the java plugin control panel ($JAVA_HOME/bin/ControlPanel).
• Go to the Advanced tab.
• Expand Debug
• Check Enable tracing, Enable logging, and Show applet lifecycle exceptions
• Expand Java console
• Check Show console
• Click OK (or Close, depending on your OS)

When your applet loads the Java console will open. Click on it and immediately press '5'. It will log the jars and classes being fetched to run your applet. Some where in this there should be a message indicating what jars or classes are consider "unsigned". If you miss it the first time, just reload the window to try it again.