Local file reading by signed applets is blocked on Safari, due to a November 2013 Safari security change.

Steps to reproduce:

• Either:
  • Download the localFile.zip file, which contains a localFile.txt file in UTF-8 format that should be put into the user home directory.  On Macintosh that would put the file at Users/YourUserName/localFile.txt.  On Windows that would put the file at C:/Users/YourUserName/AppData/LocalLow/localFile.txt, or
  • Use the applet at "Local file writing by signed applets blocked by MacOS" to write at file in UTF-8 format at that location (but that applet is affected by a bug for file writing on the Macintosh so this will work only for Windows users or for those who find a workaround to the MacOS bug).
• Use a version of Oracle Java such as 7 update 40 or 7 update 45, and use Safari on MacOS, updated since early November 2013.
• Launch this page, and give permission for the signed applet to run.

Expected behavior:

• On the first line the applet should report that it can read the location of the user home directory.
• On the second line the applet should report the contents of the file (" 1384362173871"). 

The expected behavior is what is seen on Windows and on Firefox on the Macintosh.

Actual behavior:

• The applet correctly reports the location of the user home directory, but instead of reading the contents of the file it reports "(Operation not permitted)"

Regression:

This appeared at the same time as an inability to write local files, as demonstrated at "Local file writing by signed applets blocked by Safari" and the inability of a signed Java applet in Safari to launch new browser windows using Runtime.getRuntime().exec.  

Workarounds:

Firefox is not affected, but the issue in Safari can be fixed as follows: Safari > Preferences > Security > Manage Website Settings… > Java > (your site) > Run in Unsafe Mode > Trust

Source code:

import java.awt.*;
import java.applet.*;
import java.io.*;
import java.net.*;

public class localFileRead extends Applet {

public void init()
{
   setBackground(new Color(255, 240, 200));
}

public void paint(Graphics g)
{
   try
   {
     boolean macOS = (System.getProperty("os.name").startsWith("Mac"));
     boolean windowsOS = (System.getProperty("os.name").startsWith("Win"));
     String userHome = System.getProperty("user.home");
     BufferedInputStream bis = null;
     URL rootOnClientURL = null;
     if (macOS) rootOnClientURL = new URL("file", "", "//" + System.getProperty("user.home") + "/");
     else if (windowsOS) rootOnClientURL = new URL("file:/" + userHome.replace('\\', '/') + "/AppData/LocalLow/");
     g.drawString("rootOnClientURL = " + rootOnClientURL, 10, 30);
     URL url = new URL(rootOnClientURL, "localFile.txt");
     bis = new BufferedInputStream(url.openStream(), 32768);
     DataInputStream dataIS = new DataInputStream(bis);
     String s = dataIS.readUTF();
     dataIS.close();
     bis.close();
     g.drawString("Reading a local file worked. Its contents are = " + s, 10, 60);
   }
     catch (Exception e)
   {
     g.drawString("Reading a local file didn't work. The Exception is: " + e.getMessage(), 10, 70);
   }
}
} // END OF Class localFileRead

If you have any insights or comments about this page please contact Mickey Segal.  A listing of  many Java resources is at this link.