8027687: The constructors of URLPermission class do not behave as described in javad

Reviewed-by: chegar, mduigou

2 files changed, 38 insertions, 3 deletions

diff --git a/src/share/classes/java/net/HostPortrange.java b/src/share/classes/java/net/HostPortrange.java
index fc5e3d98a..3c924d8bf 100644
--- a/src/share/classes/java/net/HostPortrange.java
+++ b/src/share/classes/java/net/HostPortrange.java
@@ -114,7 +114,7 @@ class HostPortrange {
                 if (hoststr.equals("*")) {
                     hoststr = "";
                 } else if (hoststr.startsWith("*.")) {
-                    hoststr = hoststr.substring(1).toLowerCase(); // leave the '.' ?
+                    hoststr = toLowerCase(hoststr.substring(1));
                 } else {
                     throw new IllegalArgumentException("invalid host wildcard specification");
                 }
@@ -147,7 +147,7 @@ class HostPortrange {
                         hoststr = sb.toString();
                     } else {
                         // regular domain name
-                        hoststr = hoststr.toLowerCase();
+                        hoststr = toLowerCase(hoststr);
                     }
                 }
             }
@@ -161,6 +161,38 @@ class HostPortrange {
         }
     }
 
+    static final int CASE_DIFF = 'A' - 'a';
+
+    /**
+     * Convert to lower case, and check that all chars are ascii
+     * alphanumeric, '-' or '.' only.
+     */
+    static String toLowerCase(String s) {
+        int len = s.length();
+        StringBuilder sb = null;
+
+        for (int i=0; i<len; i++) {
+            char c = s.charAt(i);
+            if ((c >= 'a' && c <= 'z') || (c == '.')) {
+                if (sb != null)
+                    sb.append(c);
+            } else if ((c >= '0' && c <= '9') || (c == '-')) {
+                if (sb != null)
+                    sb.append(c);
+            } else if (c >= 'A' && c <= 'Z') {
+                if (sb == null) {
+                    sb = new StringBuilder(len);
+                    sb.append(s, 0, i);
+                }
+                sb.append((char)(c - CASE_DIFF));
+            } else {
+                throw new IllegalArgumentException("Invalid characters in hostname");
+            }
+        }
+        return sb == null ? s : sb.toString();
+    }
+
+
     public boolean literal() {
         return literal;
     }
diff --git a/src/share/classes/java/net/URLPermission.java b/src/share/classes/java/net/URLPermission.java
index 7ad56a1c2..13472a9e5 100644
--- a/src/share/classes/java/net/URLPermission.java
+++ b/src/share/classes/java/net/URLPermission.java
@@ -426,7 +426,10 @@ public final class URLPermission extends Permission {
         this.ssp = url.substring(delim + 1);
 
         if (!ssp.startsWith("//")) {
-            this.authority = new Authority(scheme, ssp.toLowerCase());
+            if (!ssp.equals("*")) {
+                throw new IllegalArgumentException("invalid URL string");
+            }
+            this.authority = new Authority(scheme, "*");
             return;
         }
         String authpath = ssp.substring(2);