• Introduction
• Preference Descriptions
  • signed.applets.local_classes_have_30_powers
  • signed.applets.codebase_principal_support
  • signed.applets.verbose_security_exception
  • signed.applets.simulate_signatures_on_system_classes
  • security.lower_java_network_security_by_trusting_proxies
• Modifying Preferences
  • Manually
  • JavaScript

INTRODUCTION

In the process of developing Netscape's security model, as well as in writing Java code which makes use of that security model, Netscape's engineers have found it useful to modify the security behavior of Communicator in several ways. We believe these modifications will prove to be just as useful for all developers on the Netscape platform. The first part of this document will describe what the preferences do.

Most of these preferences are not useful for end users, and so have no interface built in to Communicator. The second part of this document describes ways of enabling them, both manually and automatically.

signed.applets.local_classes_have_30_powers

This preference, when enabled, simulates Navigator 3.0 security behavior for local classes. This means that classes on the classpath have certain special privileges. Among these privileges are universal network connections (if setScopePermission() is used as in 3.0) and the ability to load libraries (DLLs). Without this preference enabled, these operations require the use of the Capabilities API. Note that local classes had no file access privileges in Navigator 3.0. This preference does not give them any file access privileges either. This preference also has no effect on downloaded classes (downloaded classes must still use the Capabilities API to enable privileges.)

signed.applets.codebase_principal_support

In Netscape's Capabilities-based security model for Java, a principal is a token representing the originator or source of a particular class. By default, Communicator will only allow principals that are based on cryptographic certificates (such as the Object Signing certificates in a signed JAR file or the SSL certificate in an https codebase), or that are based on file:// URLs.

With this preference enabled, Communicator will allow an http:// codebase (the URL representing the location of the class file) to serve as a principal, which allows developers to bypass the signing stage while developing secure code.

Please see Security TechNote #2 for more information on codebase principals.

signed.applets.verbose_security_exception

When enabled, this preference causes printStackTrace() in security-related exceptions to print a complete stack trace (rather than just the name of the exception.) In order to get the most detailed stack traces, you will also need to disable the JIT (Just In Time compiler). Here's how to disable the JIT:

1. Rename the JIT library to a different name (on Windows, the JIT is named "jit3240.dll" and is located in the directory >Netscape Directory<\Program\Java\Bin.)
2. Shut down all copies of your Communicator.
3. Start one copy of your Communicator.
4. Open a Java Console to verify that the JIT is now disabled (The JIT displays a message in the Java Console if it is active.)
5. If the JIT is still active, you may need to reboot your system.

signed.applets.simulate_signatures_on_system_classes

When enabled, this preference allows the system classes to be modified without checking for a valid signature on the modified classes. This preference may be useful if you wish to experiment with replacing any of the various system classes shipped with Communicator. Please use caution when doing so.

security.lower_java_network_security_by_trusting_proxies

When a Java Applet attempts to "phone home", or make a socket connection to its originating host, Communicator will first perform a DNS lookup to prevent certain "spoofing" attacks. In some intranets, DNS lookup for external hosts is disabled, and all external traffic goes through a proxy. In this situation, the applet will normally fail to make the desired connection.

With this preference enabled, if the lookup fails, then textual name equivalence is used to determine if the class can make a connection. This option causes the "name of the home" to be relied upon rather than the stricter DNS/IP address.

This is one of the few "hidden" security preference which end users in some intranets may need to enable.

MODIFYING PREFERENCES

There are four primary ways to change a preference in Communicator:

1. Use the User Interface provided in the Communicator "Preferences..." panel.
2. Manually edit the Preferences file.
3. Write a signed JavaScript.
4. Use an existing signed JavaScript.

As mentioned previously, none of the preferences described in this document has a User Interface in Communicator 4.0, so the first option is out.

For those of you who want to get down and dirty, read on.

Modifying Preferences Manually

You can modify Communicator preferences "manually" by editing your Preferences file. The name and location of this file varies from platform to platform:

• On Windows 95 and NT, \Program Files\Netscape\Users\<user name>\prefs.js
• On UNIX, ~/.netscape/preferences.js
• On Macintosh, "System Folder:Preferences:Netscape f:Netscape Preferences"

Be sure to edit this file only while all instances of Communicator are shut down, as Communicator will overwrite prefs.js when it exits. To enable a preference, add a line like this to the Preferences file:

user_pref("signed.applets.codebase_principal_support", true);

Substitute the name of the preference you wish to enable for the first argument of user_pref().

To disable a preference, find the user_pref() line for that preference in the Preference file, and set the value to "false".

Modifying Preferences Automatically with JavaScript

If you've mastered Object Signing Certificates, Page Signer, and the Capabilities API, then writing a signed JavaScript to automatically view and set one or more preferences will be a cinch. ;-)

In order to examine the state of a preference with JavaScript, use a script like the following:

<SCRIPT LANGUAGE="JavaScript1.2" ARCHIVE="ScriptSigs.jar" ID="ReadPrefScript"> netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesRead"); var prefValue = navigator.preference("security.lower_java_network_security_by_trusting_proxies"); document.write("The current value of the proxy preference is: " + prefValue); </SCRIPT>

"ScriptSigs.jar", in this case, is the name of JAR file which contains the signatures for scripts in this document. (See the Page Signer documentation for more information on signing scripts.) "UniversalPreferencesRead" is the name of the target which allows a script to read preference values. navigator.preference() is the method which you can use to read and write those values, once you've enabled the proper privileges.

In order to set the state of a preference with JavaScript, use a script like this:

<SCRIPT LANGUAGE="JavaScript1.2" ARCHIVE="ScriptSigs.jar" ID="WritePrefScript"> netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesWrite"); navigator.preference("security.lower_java_network_security_by_trusting_proxies", "true"); </SCRIPT>

"UniversalPreferencesWrite" is the name of the target which allows a script to write preference values. When navigator.preference() receives a second parameter, it sets the value of the preference to that parameter (assuming that you've enabled the UniversalPropertyWrite target.)

TN-SEC-03-9706

Any sample code included above is provided for your use on an "AS IS" basis, under the Netscape License Agreement - Terms of Use