Problem while loading Java Applet, IE 7 RC1 Crashes

[codeexploiter]

Hi,

I found some problem while loading a Java applet in Internet Explorer 7 Release Candidate 1.

Please check the following code that I had used for loading the applet in my HTML page.



<SCRIPT LANGUAGE="JavaScript"><!--
var _info = navigator.userAgent;
var _ns = false;
var _ie = (_info.indexOf("MSIE") > 0 && _info.indexOf("Win") > 0 && _info.indexOf("Windows 3.1") < 0);
//--></SCRIPT>
<COMMENT>
<SCRIPT LANGUAGE="JavaScript1.1"><!--
var _ns = (navigator.appName.indexOf("Netscape") >= 0
&& ((_info.indexOf("Win") > 0 && _info.indexOf("Win16") < 0
&& java.lang.System.getProperty("os.version").indexOf("3.5") < 0)
|| _info.indexOf("Sun") > 0));
//--></SCRIPT></COMMENT>


<!-- The following code is repeated for each APPLET tag -->
<SCRIPT LANGUAGE="JavaScript"><!--
if (_ie == true) document.writeln('<OBJECT classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93" width="0" height="0" codebase="http://java.sun.com/products/plugin/1.4/jinstall-14-win32.cab#Version=1,4,0,mn"> <NOEMBED><XMP>');
else if (_ns == true) document.writeln('<EMBED type="application/x-java-applet;" width="0" height="0" code="abc.def.ghi.MyApplet.class" codebase="./" name="MyApplet" archive="MyApplet.jar" TRACE_CGI="on" CONNECTION_TIMEOUT="30" OUTPUT_FUNCTION="addOutput" mayscript="true" pluginspage="http://java.sun.com/j2se/1.4/download.html">
<NOEMBED><XMP>');
//--></SCRIPT>

<applet codebase = "./" code="abc.def.ghi.MyApplet.class" archive="MyApplet.jar" name="MyApplet" width=0 height=0 mayscript>

</XMP>
<PARAM NAME="java_code" VALUE="abc.def.ghi.MyApplet.class">
<PARAM NAME="java_codebase" VALUE="./">
<PARAM NAME="java_type" VALUE="application/x-java-applet;">
<param name="java_archive" value="MyApplet.jar">
<param name="mayscript" value="true">
<param name="TRACE_CGI" value="on">
<param name="CONNECTION_TIMEOUT" value="30">
<param name="OUTPUT_FUNCTION" value="addOutput">
<PARAM NAME="scriptable" VALUE="true">
No Java 2 SDK, Standard Edition v 1.4 support for APPLET!!
</APPLET></NOEMBED></EMBED>
</OBJECT>

<!--
<APPLET code="XYZApp.class" codebase="html/" align="baseline"
width="200" height="200">
<PARAM NAME="model" VALUE="models/HyaluronicAcid.xyz">
No Java 2 SDK, Standard Edition v 1.4 support for APPLET!!
</APPLET>
-->


The above code loads the Applet without any problem in all the other browsers including IE 7 RC1.

But while loading the applet in IE7 it shows a Javascript error on the following line


document.writeln('<EMBED type="application/x-java-applet;" width="0" height="0" code="abc.def.ghi.MyApplet.class" codebase="./" name="MyApplet" archive="MyApplet.jar" TRACE_CGI="on" CONNECTION_TIMEOUT="30" OUTPUT_FUNCTION="addOutput" mayscript="true" pluginspage="http://java.sun.com/j2se/1.4/download.html">
<NOEMBED><XMP>');


Something like unterminated string, this javascript error is not displaying on any other browser. :)

Now what i've done is i've removed the space before <NOEMBED><XMP>'); tag since it is a part of a single document.writelin statement and saved my HTML page and loaded into IE7 RC1 at that point it crashed and shown an error. I'v attached the image of the error message in this post.

When i give that space as i mentioned in my script above the java applet loads and works correctly except that it shows a Javascript error.

I would like to know your thoughts on this issue.

Thanks in advance

[nikster2004]

Hi - thanks for this information. It helped us narrow down and finally fix the issue.

I did a pretty detaied analysis on this JavaScript - generated by HTMLConverter - and found that it does generate HTML that's simply not valid. I won't go into the details, but here are a few highlights:
- Use of <XMP> which is deprecated
- Wrong end tags depending on which version you are looking at. There are unconditional end tags for all options of serving the applet: OBJECT, EMBED, and APPLET.
- The EMBED code looks completely wrong as it serves both the embed with all parameters as attributes _and_ the <param...> parameters from the Applet tag. Does not matter too much because EMBED seems to be only for really old versions of Netscape.
- The OBJECT rewrite has - at least in our version - tons of duplicate parameters.

The fix: I first made pristine HTML tags for each of the three options: OBJECT, EMBED, and APPLET. Then I put the code that determines the browser type on the server side - I could do that because we were already serving the page from a JSP, so putting the code server side was no effort at all. You don't have some of the options that JavaScript has but if you look at WikiPedia's collection of User-Agent strings, it's trivial to write some code that can distinguish between IE, Netscape before version 6, and all other browsers, just like the JS.

The output is now clean, clear HTML for both IE and Firefox. The OBJECT tag delievered directly - and without JS document-rewrite or superflous end tags and other fishy constructs like the HTMLConverter uses - works as designed in IE 7 RC1.

What a mess! I mostly blame the HTMLConverter for this, the code generated by that is a total hack and not even close to correct HTML. It took me ages just to figure out what it actually _does_.

[codeexploiter]

Thanks for the detailed information about the issue.