6981426: limit use of TRACE method in HttpURLConnection
authormichaelm
Thu Sep 23 08:56:38 2010 -0700 (2 years ago)
changeset 445c4573f15b0f8
parent 4446e389e6349c9
child 4461eaaf0f77762
6981426: limit use of TRACE method in HttpURLConnection
Reviewed-by: chegar
src/share/classes/java/net/HttpURLConnection.java
--- a/src/share/classes/java/net/HttpURLConnection.java Thu Sep 23 08:50:17 2010 -0700
+++ b/src/share/classes/java/net/HttpURLConnection.java Thu Sep 23 08:56:38 2010 -0700
@@ -344,6 +344,12 @@ abstract public class HttpURLConnection
for (int i = 0; i < methods.length; i++) {
if (methods[i].equals(method)) {
+ if (method.equals("TRACE")) {
+ SecurityManager s = System.getSecurityManager();
+ if (s != null) {
+ s.checkPermission(new NetPermission("allowHttpTrace"));
+ }
+ }
this.method = method;
return;
}