Karakun Support Forums

I was able to run snyk test locally on OWS and ITW codebase and it has generated reports. Will try to fix the vulnerabilities.

@Janak - I have a similar concerns as John above. Based on my own experience, these seem to be consistent with the results I see for OpenWebStart using Snyk as the SAST. Would you be still be willing to verify and fix the findings, as offered above? Would love to have these issues resolved ...

We will include this in the next release, scheduled for the end of May,

1. So you were able to install OWS successfully.

2. Then you launched your Jnlp file with OWS.

3. OWS downloads resources and verifies the signing certificate and show the Security Dialog asking to trust the application.

4. You choose "Always Trust" and click on the Run button.

5. Your ...

Hi,

Just to clarify:

1. You installed OWS by running the installer OpenWebStart_windows-x64-x64_1_13_0.exe

2. Your are saying that during the last step of installation " it says that a page will open so it can be marked as trusted and so on"
I am not clear about this. The last screen of installer ...

Thanks for suggesting Snyk. We will verify and fix.

In addition to the VM arguments specified in the JNLP file, you can provide additional arguments through the environment variable JAVAWS_VM_ARGS. If any argument you add is not included in the list of valid VM arguments recognized by OWS, it must first be added to the JVM argument whitelist in the ...

You can pass a JVM argument to the JVM that starts the App specified in the Jnlp file in the following ways:

1. In the Jnlp file:


<<j2se version="1.8*" java-vm-args="-Dawt.useSystemAAFontSettings=lcd"/>


2. In the env var JAVAWS_VM_ARGS

3. You can specify JVM args for a particular Jnlp file ...

When OWS is run for the first time it creates C:\Users\USERNAME.config\icedtea-web and C:\Users\USERNAME.cache\icedtea-web directories and files under them. So, when OWS has never been executed before on a machine and two Jnlps are started simultaneously with OWS, race conditions can occur when the ...

Happy that it works. Thanks for letting us know.

There seems to be a race condition. Trying to reproduce and fix.

Firstly, this is a public forum, so any log files you attach can be seen by others. Make sure they don’t include anything sensitive before posting. You get a private forum when you buy support: https://openwebstart.com/support/

OWS downloads jar files specified in the Jnlp file. However, some jar ...

To make OWS compatible with Java 25 is going to be a major effort as some classes on which OWS depends have been removed from Java 23 and 24. Given our limited resources, we will undertake the effort only if we have adequate sponsorship from the users of OWS.

Can you please tell me which company do ...

Hi John,

Can you please tell me which SAST tool was used So that I can also check for myself, do the fixes and verify them by running the tool again?

Thanks

Sure we can provide a statement.

Can you please tell me :

Which company do you belong to?
Which company/group is interested in the vulnerability report?
Which tool was used to produce the report? Is the tool available in github?
Was the tool run from within github on the codebase in github?
Was ...

Thanks for the log. I will have a look. I also saw your post on ows github https://github.com/karakun/OpenWebStart ... 3870281584

Can you send us the OWS logs for both the Jnlp applications? https://openwebstart.com/docs/OWSGuide.html#_logging

>
we have OWS 1.12.0 on Windows Server 2022 Citrix Environment with roaming profiles
>
Can you please explain what does "Citirx Environment with roaming profiles mean" .
>
We launch 2 JNLPs nearly parallel.
>
Are the two Jnlps located at different URLs and pointing to different applications?

How ...

I had a look at the logs which you have copied in your email. I would have preferred if you had sent me the stage 1 and stage 2 log files after masking the sensitive data.

Jars and Jnlp are downloaded through the configured proxy. The application is started successfully. The application is making ...

Which version OWS are you using?

Did you set the proxy using the itw-settings tool?

From the logs below , it seems OWS is starting your app. OWS must be downloading Jnlp and Jars through the proxy. What happens if you cut off access to the proxy? Does OWS throw an error while downloading Jnlp and ...