Access denied error for midi file in same directory as applet!

[Sam Foletta]

Hi! First time caller, long time listener.

I'm getting an access denied error trying to load a midi file on the server, in a subdirectory of the applet's folder. As in, the applet root/ffp.class, on webpage root/ffp.htm, is trying to access root/mid/wm0.mid, and is denied access.

It works fine when I run the applet on my hard disk, but run from the server it throws an AccessControlException (access denied). This is odd, because I can put the same midi file into an AudioClip and run it with no problem. However, I don't have much control over playback with AudioClip and prefer to use a midi sequencer. I'm trying to load the midi file as a FileInputStream which, again, works fine when I run it on my hard disk, but doesn't work once I upload it onto the server.

Shouldn't the applet already have access to files in subdirectories without modifying permissions? Especially if the applet can already access the same files as a different data type? I feel like I'm missing something here.

The code is basically the following:

    public Sequence wm0;
    public Sequencer mid;

    public ffp() {
        try {
            mid=MidiSystem.getSequencer();
            mid.open();
            mid.addMetaEventListener(this);
            wm0=MidiSystem.getSequence(new FileInputStream("mid/wm0.mid"));
        } catch (MidiUnavailableException ex) {
        } catch (FileNotFoundException ex) {
        } catch (InvalidMidiDataException ex) {
        } catch (IOException ex) {}
    }

The line that calls MidiSystem.getSequence throws the following error:

java.security.AccessControlException: access denied (java.io.FilePermission mid\wm0.mid read)
	at java.security.AccessControlContext.checkPermission(Unknown Source)
	at java.security.AccessController.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkRead(Unknown Source)
	at java.io.FileInputStream.<init>(Unknown Source)
	at java.io.FileInputStream.<init>(Unknown Source)
	at ffp.<init>(ffp.java:745)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
	at java.lang.reflect.Constructor.newInstance(Unknown Source)
	at java.lang.Class.newInstance0(Unknown Source)
	at java.lang.Class.newInstance(Unknown Source)
	at sun.plugin2.applet.Plugin2Manager.createApplet(Unknown Source)
	at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
	at java.lang.Thread.run(Unknown Source)
Exception: java.security.AccessControlException: access denied (java.io.FilePermission mid\wm0.mid read)

Would very much appreciate any help.

[Ulf Dittmer]

You can't use file I/O in this situation. Those classes will try to access the client file system, and that's out of bounds for applets.

You'll need to use the MidiSystem.getSequence(InputStream) method like this:

URL fileURL = new URL( getCodeBase() , "mid/wm0.mid" );
InputStream is = fileURL.openStream();

[Sam Foletta]

So, I tried that, getCodeBase() threw a NullPointerException so I moved that line from the constructor to init(), but now I get this:

java.security.AccessControlException: access denied (java.net.SocketPermission www.cwahi.net:80 connect,resolve)
	at java.security.AccessControlContext.checkPermission(Unknown Source)
	at java.security.AccessController.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkConnect(Unknown Source)
	at sun.plugin2.applet.Applet2SecurityManager.checkConnect(Unknown Source)
	at sun.net.www.http.HttpClient.openServer(Unknown Source)
	at sun.net.www.http.HttpClient.<init>(Unknown Source)
	at sun.net.www.http.HttpClient.New(Unknown Source)
	at sun.net.www.http.HttpClient.New(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.connect(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.followRedirect(Unknown Source)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
	at java.net.URL.openStream(Unknown Source)
	at ffp.init(ffp.java:801)
	at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
	at java.lang.Thread.run(Unknown Source)
Exception: java.security.AccessControlException: access denied (java.net.SocketPermission www.cwahi.net:80 connect,resolve)

I tried signing the applet, no luck there. Do I need to use privileges? This seems so excessively problematic for loading a midi.

[Ulf Dittmer]

It should not be necessary to sign the applet, nor to use privileges. "www.cwahi.net" is the server where the applet originates from?

By the way, you shouldn't use constructors in applets at all - that's what the init() method is for.

[Sam Foletta]

Yes, cwahi.net is the same server, the midi is in a subdirectory of the applet's directory.

I tried calling getSequence with InputStream, URL, and File inputs with the same results, even tried skipping the sequence altogether and calling setSequence with an InputStream, no luck. I placed the call in a PrivilegedAction and signed the script just to try everything. Always an access denied error.



UPDATE:
Picking through the console at a higher trace level, I noticed that other resources were being redirected to "stopit.php". When I opened it up in Firefox, it brought up a page that states direct/hot linking is not allowed. It looks like the host server is blocking the applet's connection to these files thinking that they're being linked to by a foreign web site. Yet image files still get through somehow. Hmm...

Any way to get around that?

[Ulf Dittmer]

The server is *probably* looking for a REFERER header (which a web browser would send if the file was linked from a web page). If that's the case then it gets slightly more tricky, but something like this should work:

URL fileURL = new URL( getCodeBase() , "mid/wm0.mid" ); 
URLConnection conn = (URLConnection) fileURL.openConnection();
conn.setRequestProperty("REFERER", getDocumentBase());
InputStream is = conn.getInputStream();

It could be something else about the request that the server doesn't like, though - the server admin should be able to tell you what.

[Sam Foletta]

You're absolutely right. Just added a "toString()" and it worked like a charm.

Final code looked something like this:

    public void init() {
        try {
            mid=MidiSystem.getSequencer();
            mid.open();
            mid.addMetaEventListener(this);
            URL fileURL=new URL(getCodeBase(),"mid/wm0.mid");   
            URLConnection conn=(URLConnection) fileURL.openConnection();  
            conn.setRequestProperty("REFERER",getDocumentBase().toString());  
            InputStream is=conn.getInputStream();
            wm0=MidiSystem.getSequence(is);
        } catch (MidiUnavailableException ex) {
        } catch (FileNotFoundException ex) {
        } catch (InvalidMidiDataException ex) {
        } catch (IOException ex) {}

and later...

        try {
            mid.setSequence(wm0);
        } catch (InvalidMidiDataException ex) {}

I ran into the same problem with AudioClips, actually, and since they only accept URLs and not InputStreams I assume this fix won't work and I'll have to use Clips and AudioSystem.

Anyways... thanks for the help!