IllegalArgumentException at URLPermission in jre8

Question

when i run the code below,

-in an Applet on JRE8, on the line con.getInputStream() it throws the exception

-in an Applet on JRE7 or JRE6 it does not throws.

-in a Desktop app on any JRE it does not throws.

when i remove the lines starts with setRequestPropery, it does not throws the exception on any JRE.

        URLConnection con = new URL(adress).openConnection();
        con.setDoOutput(true);
        con.setDoInput(true);
        con.setUseCaches(false);
        con.setRequestProperty("Content-Type",
                "application/octet-stream");
        con.setRequestProperty("pragma:", "no-cache");
        PrintStream ps = new PrintStream(con.getOutputStream());
        ps.println("Test");
        ps.close();
        in = new DataInputStream(conn.getInputStream());

Exception:

java.lang.IllegalArgumentException: invalid actions string
at java.net.URLPermission.init(Unknown Source)
at java.net.URLPermission.<init>(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.URLtoSocketPermission(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source)

In my applet, i am trying to open a connection and i need those request properties.

Do you know what causes this exception on JRE8? and why only in an applet and not desktopapp.

Answer 1

Debugin your code snippet in an applet, shows that the parameter actions passed to URLPermission, which ist new win java8, has the value GET:pragma: which is not valid according to javadoc for that argument:

The actions string of a URLPermission is a concatenation of the method list and the request headers list. These are lists of the permitted request methods and permitted request headers of the permission (respectively). The two lists are separated by a colon ':' character and elements of each list are comma separated. Some examples are:

     "POST,GET,DELETE"
     "GET:X-Foo-Request,X-Bar-Request"
     "POST,GET:Header1,Header2"

and according to the code in oracle's jdk8:

int colon = actions.indexOf(':');
if (actions.lastIndexOf(':') != colon) {
    throw new IllegalArgumentException("invalid actions string");
}

The code above expects one single colon or none.

To solve the problem you need to remove the colon after pragma in your call

con.setRequestProperty("pragma", "no-cache");

Running your snippet as simple junit test does not provoke this exception, because the URLPermition class is not invoked. Whether it invoked or not depends on the context where the application is running.

Note. Depending on the context of use, some request methods and headers may be permitted at all times, and others may not be permitted at any time. For example, the HTTP protocol handler might disallow certain headers such as Content-Length from being set by application code, regardless of whether the security policy in force, permits it.

So it seems, when in the context of an applet some permition checks are performed.