Java Security, 2nd Edition

Code Sources

Code sources are a combination of codebases and signers. The signer field must match the alias listed in the keystore, as we’ve just described. Codebases can be any valid URL. Because they are URLs, codebases always use forward slashes, even if the code is being read from the filesystem: file:/C:/files/jdk1.3/ is the correct specification for the directory C:\files\jdk1.3\ (although remember that if the drive is the default drive, you can leave it out and specify the URL as file:///files/jdk1.3/ ).

Codebases can use property substitution much like we showed when discussing file properties. Hence, the codebase for the Java extension directory can be universally specified as file:${java.home}/lib/ext/. This trick applies somewhat to the classpath: if you want a particular set of permissions to apply to all classes on the classpath then you can use the codebase file:${java.class.path}/. However, this works only when there is a single directory or JAR file in the classpath since only those cases result in a correct URL.

The ending of the codebase URL is very important. There are four cases:

• The URL specifies a jar file (http://www.sun.com/sdo/sdoapp.jar).

  Only the classes in the jar file belong to the codebase.

• The URL ends with a slash (http://www.sun.com/sdo/).

  Only class files in the given directory belong to the codebase. Jar files in the given directory do not belong to the codebase.

• The URL ends with an asterisk (http://www.sun.com/sdo/*).

  Both jar files and class ...