Perhaps you can use getDocumentBase
instead. Depends on the structure of your setup, whether there is a close relation between the code base and the documents. No permanent solution: getDocumentBase
was modified in the same way in 7u40, according to bug #8019177.
If not, then you can try using getResource
to obtain a URL from your JAR, e.g. the class file of the applet, and then disassemble that URL to get at the location of the JAR and hence the code base. This is untested, so feel free to edit this post if you tried this.
Last but not least, since that change only affects local applets, you could run a (local or public) web server to serve that applet.
If you want a more official statement on this, I'll quote the #8017250 bug report:
If applet need to load resource:
- if the resource is in applet JAR(s), they should be able to load it with
ClassLoader.getResoruceAsStream
directly, without needing the codebase information.
- if the resource is in arbitary location, not inside applet JAR, they should have other ways to get to that location, since it's not part of the applet resource anyway. (e.g.
user.home
java system property, provided that their applet has all-permissions)
http://www.duckware.com/tech/java-security-clusterfuck.html (thanks to this post) mentions some other alternatives. The least likely one to be affected by future Oracle modifications apprers to be the use of location.href
in the containing HTML page, e.g. writing the <applet>
tag from JavaScript.