Exploiting SAS® Software Using Java™ Technology Barbara Walters, SAS Institute Inc., Cary, NC Java programs are often delivered via the Internet. In order to protect the local machine from malicious programs, the Java language and the JVM Abstract provide a secure environment for application execution. The secure This paper describes how to use Java™ technology with SAS software. environment ensures that the client machine (the machine where the SAS Institute currently offers several Java development tools that allow browser is running) is not corrupted by the downloaded program and that applications to access SAS data and take advantage of SAS no information is stolen from the client machine. computational capabilities. This paper describes how to use these class libraries and address client/server configuration and performance Java security is based upon the “sandbox” model. The sandbox is the issues. set of resources (threads, socket connections, local files, etc.) that the downloaded Java code is allowed to access. The code is restricted from accessing resources outside of its sandbox. In executing Java applets, Introduction each Web browser defines the limits of the sandbox. Since its introduction in mid-1995, Java have become an integral part of The Security Manager enforces the limits of the sandbox. For applets, the World Wide Web. Java is a rich programming language that enables the Web browser controls the Security Manager. Each browser may put Web programmers to create sophisticated and responsive client/server different restrictions on applet behavior. The default limits imposed by applications. Because Java is portable and secure, users of Web the Security Manager are: applications can be confident that those applications will execute • Classes cannot access the local file system properly and not corrupt their computers. • Classes cannot read environment variables As part of the SAS/IntrNet® product, SAS Institute provides three Java components: • Classes cannot execute other programs on the local machine • SAS/SHARE*NET™ Driver for JDBC—a Java class library that • Classes cannot make socket connections to machines other than allows Java applications to access SAS data the machine from which they were downloaded. • JConnect—a Java class library that allows Java applications to The Web browser provides the Java “core” libraries. These libraries create a remote SAS session, submit SAS statements, and retrieve contain classes that are included with all Java-enabled browsers and results generated by the submitted statements may not be downloaded over the network. The JDBC driver manager is an example of a core library. It must be available on the local machine; it • JTunnel—a feature that implements HTTP tunneling to extend the is ineligible for download. flexibility of the SHARE*NET Driver and JConnect classes All Java classes are included in a “package.” The package is the By using these components, SAS programmers can make SAS hierarchical name associated with the class. Any class whose package resources available to a much wider user community via the Web. name starts with java is considered a core class. The package name for the JDBC driver manager is java.sql and is, therefore, one of the core libraries. Overview of Java As Java code starts executing, Java classes that are not installed on the Java is an object-oriented programming language developed by Sun local machine and are not core classes are dynamically downloaded Microsystems, Inc. Java source code is compiled to a byte stream, from a Web server. Classes are loaded as they are needed, so the which is merely a long sequence of bytes. The byte stream is interpreted number of classes downloaded from the network can be kept to a by the Java Virtual Machine (JVM). Since Java is interpreted, the code minimum. Downloaded classes are subject to the restrictions imposed will run on any platform that has an implementation of the JVM. This by the Security Manager. enables Java programmers to write a single application that will run on many platforms—the JVM ensures that the program executes properly The following is an example of an applet tag in an HTML document that on the receiving machine. loads a Java class called testapplet.class. Many Web browsers, such as Netscape Navigator and Microsoft’s <applet code="testapplet.class" width=600 Internet Explorer, include a version of the JVM as part of the browser. height=425> Applications written in Java that are accessed via an HTML page are called applets. Because applets execute within any JVM-enable Web Figure 1: Sample applet tag browser, they have become a very popular form of portable, secure, and dynamically loaded Web-enabled application. Most of the topics in this When the browser encounters the applet tag, it invokes the JVM and paper address the creation of Java applets as opposed to Java passes it the name of the applet class. If the applet class itself was applications downloaded from the Web server, the Security Manager restricts the resources for all classes executed as part of the applet. Java provides libraries of classes that offer a rich set of functionality. These include a library for graphical user interface (GUI) components With JDK 1.1, Java classes may contain digital signatures. Applet called AWT (Abstract Window Toolkit), an I/O library, and a network classes that are downloaded from the Web server and are not digitally access library. Java Developer’s Kit (JDK) Release 1.1 provides a signed are considered “untrusted.” JDK 1.1 provides a Security API that library for the JDBC driver manager. These libraries are standard and allows special privileges for digitally signed applets, which are “trusted are included with the JVM. 1 applets.” The production release of JDK 1.1 was made available in February 1997. Unfortunately, neither Microsoft’s Internet Explorer nor ResultSet resultset = statement.executeQuery Netscape Navigator have JDK 1.1 support as of the writing of this paper, (“select columnone from my.table”); so the enhanced security manager cannot be addressed in this paper. while (resultset.next() == true) String columnOne = resultset.getString(1); SAS/SHARE*NET Driver for JDBC™ System.out.println(“Results: “ + columnOne); The SAS/SHARE*NET Driver for JDBC is one of the Java components provided in the SAS/IntrNet product. A class library that allows Java } catch (SQLException e) { applications to access SAS data, the SAS/SHARE*NET Driver uses the System.out.println(“Exception thrown: ” Java Database Connectivity (JDBC) API created by JavaSoft. JDBC is + e.getMessage(); similar to ODBC, but for the Java environment. Users do not need JDBC } drivers installed on their machines—drivers are dynamically downloaded Figure 2: Code to Create Objects (continued) from a Web server as needed. The JDBC API provides an SQL interface to databases. By using JDBC, In this code segment, the SAS/SHARE*NET server is running on the applications and applets can establish a connection to a database machine named sharenetserver and portnumber is the number of server, submit SQL statements, and obtain result sets. Applications can the port assigned to the SAS/SHARE*NET server. The SQL statement obtain information about the database (database metadata) and a requests all of the rows for the column named columnone in the table particular result set (result set metadata). named my.table. Database metadata contains information about the characteristics of the All of the classes for the SAS/SHARE*NET Driver are contained in the database and what data it contains. For example, through database package named COM.sas.net.sharenet. The driver is written metadata, a program can determine which numeric or string operations entirely in Java and may be dynamically downloaded from the Web can be used in an SQL statement. The program can obtain a list of valid server. (Please keep in mind that the JDBC driver manager must be data types supported by the database. It may ask the names of tables available on the client machine. It may not be dynamically downloaded.) available from a particular database server, the names of the columns The name of the database metadata class is within those tables, and the type of data contained in each column. java.sql.DatabaseMetaData. It supports several methods, Although drivers themselves can be downloaded over the network, the including getSchemas, and getTables. “Schemas” are analogous to JDBC driver manager must be available on the local machine. The SAS libraries; “tables” are analogous to SAS data sets. The JDBC driver manager is included with JVMs based on JDK 1.1. SAS/SHARE*NET Driver cannot provide metadata information about a JavaSoft maintains information about JDBC and has the driver manager foreign database such as Oracle. It can only provide this type of available at its Web site. The SAS/SHARE*NET Driver available for information about the SAS databases. download from SAS Institute’s Web site conforms to the JDBC 1.1 API The DatabaseMetaData object can be created after a connection has specification from JavaSoft. (For the URLs, see the References at the been established to the database (i.e., a java.sql.Connection end of this document.) object has been created). The result set metadata class java.sql.ResultSetMetaData Using the SAS/SHARE*NET Driver for JDBC provides methods for obtaining number of columns, column names, Databases are accessed through a unique style of URL that is defined labels, and other characteristics of a particular result set. The for JDBC. Each database protocol has a unique URL registered with ResultSetMetaData object can be created from any ResultSet JavaSoft for use with JDBC. The format of the URL for the object. SAS/SHARE*NET Driver is Figure 3 depicts a typical configuration for an untrusted applet accessing jdbc:sharenet://host:port. a remote SAS/SHARE*NET server.