# HG changeset patch
# User nikgor
# Date 1389125856 28800
# Node ID 8e8c84d9535f030ff5b29fcc5d85c91995dbe022
# Parent  b33efb12ef2ead8f33a4559b6cd449a63e1d69e9
8004562: Better support for crossdomain.xml
Reviewed-by: herrick, ngthomas, chegar

diff -r b33efb12ef2e -r 8e8c84d9535f jdk/src/share/classes/sun/net/www/protocol/http/HttpURLConnection.java
--- a/jdk/src/share/classes/sun/net/www/protocol/http/HttpURLConnection.java	Wed Jan 08 13:25:30 2014 +0100
+++ b/jdk/src/share/classes/sun/net/www/protocol/http/HttpURLConnection.java	Tue Jan 07 12:17:36 2014 -0800
@@ -541,9 +541,11 @@
              * to last and last, respectively, in the case of a POST
              * request.
              */
-            if (!failedOnce)
+            if (!failedOnce) {
+                checkURLFile();
                 requests.prepend(method + " " + getRequestURI()+" "  +
                                  httpVersion, null);
+            }
             if (!getUseCaches()) {
                 requests.setIfNotSet ("Cache-Control", "no-cache");
                 requests.setIfNotSet ("Pragma", "no-cache");
@@ -554,7 +556,12 @@
             if (port != -1 && port != url.getDefaultPort()) {
                 host += ":" + String.valueOf(port);
             }
-            requests.setIfNotSet("Host", host);
+            String reqHost = requests.findValue("Host");
+            if (reqHost == null ||
+                (!reqHost.equalsIgnoreCase(host) && !checkSetHost()))
+            {
+                requests.set("Host", host);
+            }
             requests.setIfNotSet("Accept", acceptString);
 
             /*
@@ -671,6 +678,44 @@
         }
     }
 
+    private boolean checkSetHost() {
+        SecurityManager s = System.getSecurityManager();
+        if (s != null) {
+            String name = s.getClass().getName();
+            if (name.equals("sun.plugin2.applet.AWTAppletSecurityManager") ||
+                name.equals("sun.plugin2.applet.FXAppletSecurityManager") ||
+                name.equals("com.sun.javaws.security.JavaWebStartSecurity") ||
+                name.equals("sun.plugin.security.ActivatorSecurityManager"))
+            {
+                int CHECK_SET_HOST = -2;
+                try {
+                    s.checkConnect(url.toExternalForm(), CHECK_SET_HOST);
+                } catch (SecurityException ex) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+
+    private void checkURLFile() {
+        SecurityManager s = System.getSecurityManager();
+        if (s != null) {
+            String name = s.getClass().getName();
+            if (name.equals("sun.plugin2.applet.AWTAppletSecurityManager") ||
+                name.equals("sun.plugin2.applet.FXAppletSecurityManager") ||
+                name.equals("com.sun.javaws.security.JavaWebStartSecurity") ||
+                name.equals("sun.plugin.security.ActivatorSecurityManager"))
+            {
+                int CHECK_SUBPATH = -3;
+                try {
+                    s.checkConnect(url.toExternalForm(), CHECK_SUBPATH);
+                } catch (SecurityException ex) {
+                    throw new SecurityException("denied access outside a permitted URL subpath", ex);
+                }
+            }
+        }
+    }
 
     /**
      * Create a new HttpClient object, bypassing the cache of