new class HttpURLPermission

[Andreas Rieber]

Hi,

i just had a look at the new HttpURLPermission and there might be an 
issue in normalizeMethods(). It throws only IllegalArgumentException for 
SP and HT, there are a few more illegal characters. Other than that the 
method is case-sensitiv. Also the used wild-card '*' is a valid method.

Not a bid deal as it is documented.

-Andreas


Here the related parts from RFC 2616

5.1.1 Method

   The Method  token indicates the method to be performed on the
   resource identified by the Request-URI. The method is case-sensitive.

        Method         = "OPTIONS"                ; Section 9.2
                       | "GET"                    ; Section 9.3
                       | "HEAD"                   ; Section 9.4
                       | "POST"                   ; Section 9.5
                       | "PUT"                    ; Section 9.6
                       | "DELETE"                 ; Section 9.7
                       | "TRACE"                  ; Section 9.8
                       | "CONNECT"                ; Section 9.9
                       | extension-method
        extension-method = token


2.2 Basic Rules

...
        CHAR           = <any US-ASCII character (octets 0 - 127)>
...
        CTL            = <any US-ASCII control character
                         (octets 0 - 31) and DEL (127)>
        SP             = <US-ASCII SP, space (32)>
        HT             = <US-ASCII HT, horizontal-tab (9)>
...
        token          = 1*<any CHAR except CTLs or separators>
        separators     = "(" | ")" | "<" | ">" | "@"
                       | "," | ";" | ":" | "\" | <">
                       | "/" | "[" | "]" | "?" | "="
                       | "{" | "}" | SP | HT

So a token is:
!#$%&'*+-.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ^_`abcdefghijklmnopqrstuvwxyz|~

or shorter (grouped digit and alpha):
!#$%&'*+-.[0-9][A-Z]^_`[a-z]|~