且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

Java Plug-In 启动更改以应对最近的安全漏洞

更新时间:2023-11-14 19:22:16

简短回答

所有小程序,无论是受信任的还是沙盒的,现在都会在加载前提示(向用户询问权限).

Short answer

All applets, trusted or sand-boxed, are now prompted (the user is asked permission) before loading.

这里我使用 Oracle 自己的 Test Java 小程序进行测试.之所以选择它,是因为它相对较小,经过沙盒处理,并且由我们正在测试的同一个 JRE/插件的制造商提供.

Here I am testing using Oracle's own Test Java applet. It was chosen on the basis that it is relatively small, sand-boxed and provided by the maker of the same JRE/Plug-In we are testing.

今天早上我有机会将 Java 1.7.0_11 升级到 1.7.0_13.

This morning I was offered the chance to upgrade Java 1.7.0_11 to 1.7.0_13.

虽然安全漏洞已在 1.7.0_11 中修复,但 FF &Chrome 仍然显示警告,如 禁用 Java 警告外观&对 Java Web Start 应用程序的影响.

While the security vulnerability was fixed in 1.7.0_11, FF & Chrome were still showing the warnings as seen in Disabled Java warning appearance & affect on Java Web Start apps.

随着 1.7.0_13 的推出,事情似乎又发生了变化.现在,浏览器(本身)不再警告用户,而是出现这样的 JRE 警告:

With the introduction of 1.7.0_13, things seem to have change again. Now instead of the browser (itself) warning the user, a JRE warning like this appears:

选择运行查看:

附带说明:左下方的 不再为此应用程序显示此信息 消息在过去几乎没有影响或没有影响.现在在这种情况下,它似乎可以在关闭和重新启动的浏览器以及不同浏览器之间工作.欢呼!

On a side note: That Do not show this again for this app message on the lower left had little or no effect in the past. Now in this situation, it seems to work across the browser being closed down and restarted, and between different browsers. Hurrah!

因此建议您的用户检查一下"..

So advise your users to 'check it'..

具有类似 FF 的体验,但会忽略其他浏览器中永久允许的权限.

Has an experience like FF, but ignores permissions permanently allowed in another browser.

Chrome 似乎仍然显示它对 1.7.0_11 所做的初始警告.

Chrome still seems to be showing the initial warning it did for 1.7.0_11.

然后一旦获得批准,就会转到 Oracle/Plug-In 提示,如 FF 所示.

Then once that is approved, goes to the Oracle/Plug-In prompts as seen for FF.