File Extension JNLP
File extension JNLP is used by the Java run time environment to launch 'Web Start' applications. The Java Network Launching Protocol (JNLP) was specifically designed for these applications and is defined with an XML schema. Unlike regular web applets, these applications do not run in the web browser but are downloaded onto the user's computer and executed as a normal Java application (with some restrictions). This enable developers to get around a lot of compatibility issues with web browser Java plugins and different Java Virtual Machines (JVM).
The JNLP file itself is a human readable file containing settings and configuration information formatted with XML. This information includes the location of the application's jar file, the name of the main class and any additional parameters and set up information the application needs to work correctly.
All you need to use JNLP is a JNLP client such as Java Web Start, which is installed with the Java run time environment from Sun Microsystems. This software will automatically parse the JNLP file and run the associated Java application. The JNLP client can even be installed automatically on the user's machine if they don't already have one, and the user will simply see the Web Start client download and install prior to running the Java application in these cases.
There have been a number of security issues surrounding the use of JNLP. For instance, one vulnerability was found that used a specific JNLP file to cause a buffer overflow in the Web Start client, enabling the attacker to execute malicious code with the privileges of the currently logged in user. On home user's Windows systems, this generally means administrator rights. The application could therefore do anything it liked on the user's computer. This vulnerability has since been fixed, but you should still be careful of executing any application from the internet unless it is from a trusted source.