Created attachment 136424 [details]
mockup of extended WebStart panel in SE project

JDK 7u25 introduces new security features described at

http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/no_redeploy.html

They consist in adding two new jar manifest attributes: Permissions, and Codebase. When WebStart launcher invokes the jar through jnlp, it first checks that the values of these two attributes (if present) match the settings specified in jnlp. In case of Codebase attribute it is verified that the jar is launched from a url specified in the Codebase attribute.

NetBeans 7.4 needs to accomodate these two new attributes to keep WebStart support up-to-date (Note that the change in JDK 7u25 had not been reflected in original 7.4 planning as it came to existence only very recently). This involves changing the UI both in Java SE and Java FX projects. This is not trivial due to possible unforseeable and complicated consequences, thus I am asking for help with the review.

Note that the Codebase attribute should contain any user defined jnlp Codebase values in order to fulfill the condition stated above. From UI point of view this implies that users should not need to explicitly copy jnlp Codebase user definition to the newly introduced Manifest Codebase text input component. It should be also communicated that a copy of user defined codebase is added automatically. (Should it be so?)

The question is whether to allow Permissions / Codebase attribute specification per project configuration or regardless configurations. It may seem practical to allow configuration-dependent settings, but this is not in line with current WebStart related UI nor in SE nor in FX. Configurations are considered to be Run Configurations, while all deployment settings are specified in Deployment, Packaging, and WebStart categories regardless configuration context. This can hardly be changed now being too close to UI and code freeze.


Java SE WebStart
----------------
The current implementation does not allow other than <all-permissions/> security setting, thus it seems reasonable to set Permissions attribute to the same value always. The UI needs to be extended to allow user defined Codebase specification.


Java FX WebStart
----------------
JavaFX current UI also does not allow other than <all-permissions/> security setting, thus it seems reasonable to set Permissions attribute to the same value always. The UI needs to be extended to allow user defined Codebase specification. The problem here is that there is currently no support for jnlp user defined Codebase in FX project (codebase definition is supported only in quite recent FX2 SDK versions). Therefore, it should be enough to provide a text input component for manual definition of Manifest Codebase without any reference to jnlp codebase.

I am going to attach panel mockups for discussion. 
Note that decision needs to be reached quite quickly due to upcoming deadlines.