1. /*
  2. * @(#)AWTPermission.java 1.24 03/01/28
  3. *
  4. * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
  5. * SUN PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.
  6. */
  7. package java.awt;
  8. import java.security.BasicPermission;
  9. /**
  10. * This class is for AWT permissions.
  11. * An <code>AWTPermission</code> contains a target name but
  12. * no actions list; you either have the named permission
  13. * or you don't.
  14. *
  15. * <P>
  16. * The target name is the name of the AWT permission (see below). The naming
  17. * convention follows the hierarchical property naming convention.
  18. * Also, an asterisk could be used to represent all AWT permissions.
  19. *
  20. * <P>
  21. * The following table lists all the possible <code>AWTPermission</code>
  22. * target names, and for each provides a description of what the
  23. * permission allows and a discussion of the risks of granting code
  24. * the permission.
  25. * <P>
  26. *
  27. * <table border=1 cellpadding=5 summary="AWTPermission target names, descriptions, and associated risks.">
  28. * <tr>
  29. * <th>Permission Target Name</th>
  30. * <th>What the Permission Allows</th>
  31. * <th>Risks of Allowing this Permission</th>
  32. * </tr>
  33. *
  34. * <tr>
  35. * <td>accessClipboard</td>
  36. * <td>Posting and retrieval of information to and from the AWT clipboard</td>
  37. * <td>This would allow malfeasant code to share
  38. * potentially sensitive or confidential information.</td>
  39. * </tr>
  40. *
  41. * <tr>
  42. * <td>accessEventQueue</td>
  43. * <td>Access to the AWT event queue</td>
  44. * <td>After retrieving the AWT event queue,
  45. * malicious code may peek at and even remove existing events
  46. * from its event queue, as well as post bogus events which may purposefully
  47. * cause the application or applet to misbehave in an insecure manner.</td>
  48. * </tr>
  49. *
  50. * <tr>
  51. * <td>createRobot</td>
  52. * <td>Create java.awt.Robot objects</td>
  53. * <td>The java.awt.Robot object allows code to generate native-level
  54. * mouse and keyboard events as well as read the screen. It could allow
  55. * malicious code to control the system, run other programs, read the
  56. * display, and deny mouse and keyboard access to the user.</td>
  57. * </tr>
  58. *
  59. * <tr>
  60. * <td>fullScreenExclusive</td>
  61. * <td>Enter full-screen exclusive mode</td>
  62. * <td>Entering full-screen exclusive mode allows direct access to
  63. * low-level graphics card memory. This could be used to spoof the
  64. * system, since the program is in direct control of rendering.</td>
  65. * </tr>
  66. *
  67. * <tr>
  68. * <td>listenToAllAWTEvents</td>
  69. * <td>Listen to all AWT events, system-wide</td>
  70. * <td>After adding an AWT event listener,
  71. * malicious code may scan all AWT events dispatched in the system,
  72. * allowing it to read all user input (such as passwords). Each
  73. * AWT event listener is called from within the context of that
  74. * event queue's EventDispatchThread, so if the accessEventQueue
  75. * permission is also enabled, malicious code could modify the
  76. * contents of AWT event queues system-wide, causing the application
  77. * or applet to misbehave in an insecure manner.</td>
  78. * </tr>
  79. *
  80. * <tr>
  81. * <td>readDisplayPixels</td>
  82. * <td>Readback of pixels from the display screen</td>
  83. * <td>Interfaces such as the java.awt.Composite interface or the
  84. * java.awt.Robot class allow arbitrary code to examine pixels on the
  85. * display enable malicious code to snoop on the activities of the user.</td>
  86. * </tr>
  87. *
  88. * <tr>
  89. * <td>replaceKeyboardFocusManager</td>
  90. * <td>Sets the <code>KeyboardFocusManager</code> for
  91. * a particular thread.
  92. * <td>When <code>SecurityManager</code> is installed, the invoking
  93. * thread must be granted this permission in order to replace
  94. * the current <code>KeyboardFocusManager</code>. If permission
  95. * is not granted, a <code>SecurityException</code> will be thrown.
  96. * </tr>
  97. *
  98. * <tr>
  99. * <td>showWindowWithoutWarningBanner</td>
  100. * <td>Display of a window without also displaying a banner warning
  101. * that the window was created by an applet</td>
  102. * <td>Without this warning,
  103. * an applet may pop up windows without the user knowing that they
  104. * belong to an applet. Since users may make security-sensitive
  105. * decisions based on whether or not the window belongs to an applet
  106. * (entering a username and password into a dialog box, for example),
  107. * disabling this warning banner may allow applets to trick the user
  108. * into entering such information.</td>
  109. * </tr>
  110. * </table>
  111. *
  112. * @see java.security.BasicPermission
  113. * @see java.security.Permission
  114. * @see java.security.Permissions
  115. * @see java.security.PermissionCollection
  116. * @see java.lang.SecurityManager
  117. *
  118. * @version 1.24, 01/28/03
  119. *
  120. * @author Marianne Mueller
  121. * @author Roland Schemers
  122. */
  123. public final class AWTPermission extends BasicPermission {
  124. /** use serialVersionUID from the Java 2 platform for interoperability */
  125. private static final long serialVersionUID = 8890392402588814465L;
  126. /**
  127. * Creates a new <code>AWTPermission</code> with the specified name.
  128. * The name is the symbolic name of the <code>AWTPermission</code>,
  129. * such as "topLevelWindow", "systemClipboard", etc. An asterisk
  130. * may be used to indicate all AWT permissions.
  131. *
  132. * @param name the name of the AWTPermission
  133. */
  134. public AWTPermission(String name)
  135. {
  136. super(name);
  137. }
  138. /**
  139. * Creates a new <code>AWTPermission</code> object with the specified name.
  140. * The name is the symbolic name of the <code>AWTPermission</code>, and the
  141. * actions string is currently unused and should be <code>null</code>.
  142. *
  143. * @param name the name of the <code>AWTPermission</code>
  144. * @param actions should be <code>null</code>
  145. */
  146. public AWTPermission(String name, String actions)
  147. {
  148. super(name, actions);
  149. }
  150. }