java.security.AccessControlException：訪問被拒絕（java.io.FilePermission

Question

我正在Google應用程序引擎java上創建一個應用程序，其中我必須讀取靜態文件的內容。在戰爭目錄中有一個名爲myrsakey11的文件。 PK8。

我讀文件代碼段是

public static PrivateKey getPrivateKey(String privKeyFileName) throws IOException { 
      File privKeyFile = new File(privKeyFileName); 
      FileInputStream fis = new FileInputStream(privKeyFile); 
      DataInputStream dis = new DataInputStream(fis); 

      byte[] privKeyBytes = new byte[(int) privKeyFile.length()]; 
      try { 
      dis.read(privKeyBytes); 
     } catch (IOException e1) { 
      // TODO Auto-generated catch block 
      e1.printStackTrace(); 
     } 
      dis.close(); 
      fis.close(); 

      String BEGIN = "-----BEGIN PRIVATE KEY-----"; 
      String END = "-----END PRIVATE KEY-----"; 
      String str = new String(privKeyBytes); 

      if (str.contains(BEGIN) && str.contains(END)) { 
      str = str.substring(BEGIN.length(), str.lastIndexOf(END)); 
      } 

      KeyFactory fac; 
     try { 
      fac = KeyFactory.getInstance("RSA"); 

      EncodedKeySpec privKeySpec = new PKCS8EncodedKeySpec(Base64.decode(str)); 
       return fac.generatePrivate(privKeySpec); 

     } catch (NoSuchAlgorithmException e) { 
      // TODO Auto-generated catch block 
      e.printStackTrace(); 
     } catch (Base64DecoderException e) { 
      // TODO Auto-generated catch block 
      e.printStackTrace(); 
     } catch (InvalidKeySpecException e) { 
      // TODO Auto-generated catch block 
      e.printStackTrace(); 
     } 
     return null; 
    } 

，並在此功能中我傳遞字符串「/myrsakey11.pk8」

和完整的錯誤日誌中我得到是

java.security.AccessControlException: access denied (java.io.FilePermission /myrsakey11.pk8 read) 
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:355) 
    at java.security.AccessController.checkPermission(AccessController.java:567) 
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) 
    at com.google.apphosting.runtime.security.CustomSecurityManager.checkPermission(CustomSecurityManager.java:56) 
    at java.lang.SecurityManager.checkRead(SecurityManager.java:888) 
    at java.io.FileInputStream.<init>(FileInputStream.java:133) 
    at org.ritesh.HelloWorldServlet.getPrivateKey(HelloWorldServlet.java:129) 
    at org.ritesh.HelloWorldServlet.doGet(HelloWorldServlet.java:110) 
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:617) 
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) 
    at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511) 
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1166) 
    at com.google.apphosting.utils.servlet.ParseBlobUploadFilter.doFilter(ParseBlobUploadFilter.java:102) 
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) 
    at com.google.apphosting.runtime.jetty.SaveSessionFilter.doFilter(SaveSessionFilter.java:35) 
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) 
    at com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter(TransactionCleanupFilter.java:43) 
    at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157) 
    at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:388) 
    at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216) 
    at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182) 
    at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:765) 
    at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:418) 
    at com.google.apphosting.runtime.jetty.AppVersionHandlerMap.handle(AppVersionHandlerMap.java:266) 
    at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152) 
    at org.mortbay.jetty.Server.handle(Server.java:326) 
    at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542) 
    at org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete(HttpConnection.java:923) 
    at com.google.apphosting.runtime.jetty.RpcRequestParser.parseAvailable(RpcRequestParser.java:76) 
    at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404) 
    at com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:146) 
    at com.google.apphosting.runtime.JavaRuntime$RequestRunnable.run(JavaRuntime.java:447) 
    at com.google.tracing.TraceContext$TraceContextRunnable.runInContext(TraceContext.java:454) 
    at com.google.tracing.TraceContext$TraceContextRunnable$1.run(TraceContext.java:461) 
    at com.google.tracing.TraceContext.runInContext(TraceContext.java:703) 
    at com.google.tracing.TraceContext$AbstractTraceContextCallback.runInInheritedContextNoUnref(TraceContext.java:338) 
    at com.google.tracing.TraceContext$AbstractTraceContextCallback.runInInheritedContext(TraceContext.java:330) 
    at com.google.tracing.TraceContext$TraceContextRunnable.run(TraceContext.java:458) 
    at com.google.apphosting.runtime.ThreadGroupPool$PoolEntry.run(ThreadGroupPool.java:251) 
    at java.lang.Thread.run(Thread.java:679) 

可以任何一個請告訴我如何糾正這個錯誤？

Answer 1

您是否授予對此靜態文件的訪問權限，如[1]中所述。 你如何獲得靜態文件的路徑？也許你可以使用這個文件作爲一個的ressource（把它放到WEB-INF文件夾），訪問如下：

ServletContext context = getContext(); 
InputStream resourceContent = context.getResourceAsStream("/WEB-INF/testinger.txt"); 

[1] https://developers.google.com/appengine/docs/java/config/appconfig#include-exclude

Answer 2

它發生在我的歡迎，並帶我有一段時間瞭解它：

如果您聲明文件的路徑錯誤，Google AE不會拋出FileNotFoundException，而是會拋出「AccessControlException：access denied（read）」。

確保您的路徑有效！

Answer 3

獲取部署的appengine應用程序訪問數據存儲很困難，this tutorial也沒有很好的解釋。我不使用教程中描述的環境變量，而是在我的應用程序中使用常量。 p12文件需要位於已部署應用程序可訪問的位置 - 例如/ src/main/resources /。

的方式我做它是這樣的：

1. 放入後臺應用程序，xxx.p12文件/ src目錄/主/資源，而且還因爲它需要機密添加它的.gitignore。
2. 而是從環境構建整個憑證這樣

數據存儲= DatastoreFactory.get（）創建的（DatastoreHelper.getOptionsfromEnv（） .dataset（DATASET_ID）.build（））。

由教程建議的，我做了以下

Credential credential = getCredential();  
DatastoreOptions.Builder options = DatastoreHelper.getOptionsFromEnv().credential(credential); 
datastore = DatastoreFactory.get().create(options.dataset(DATASET_ID).build()); 

其中getCredential（）被這樣定義：

private Credential getCredential() throws GeneralSecurityException, IOException { 
     final String serviceAccount = "123-xxx@developer.gserviceaccount.com"; 
     final String FILE_NAME = "/app-xxx.p12"; 

     URL url = getClass().getResource(FILE_NAME); 
     String filename = url.getFile(); 
     return DatastoreHelper.getServiceAccountCredential(serviceAccount, filename); 
    }