changeset 445:c4573f15b0f8

6981426: limit use of TRACE method in HttpURLConnection Reviewed-by: chegar
author michaelm
date Thu, 23 Sep 2010 08:56:38 -0700
parents 6e389e6349c9
children 1eaaf0f77762
files src/share/classes/java/net/HttpURLConnection.java
diffstat 1 files changed, 6 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/classes/java/net/HttpURLConnection.java	Thu Sep 23 08:50:17 2010 -0700
+++ b/src/share/classes/java/net/HttpURLConnection.java	Thu Sep 23 08:56:38 2010 -0700
@@ -344,6 +344,12 @@
 
         for (int i = 0; i < methods.length; i++) {
             if (methods[i].equals(method)) {
+		if (method.equals("TRACE")) {
+		    SecurityManager s = System.getSecurityManager();
+		    if (s != null) {
+		        s.checkPermission(new NetPermission("allowHttpTrace"));
+		    }
+		}
                 this.method = method;
                 return;
             }