The spec for java.io.File#getCanonicalPath() and
java.io.File#getCanonicalFile() declares:

"Throws:
...
    SecurityException - If a required system property value
        cannot be accessed, or if a security manager exists
        and its SecurityManager.checkRead(java.io.FileDescriptor)
        method denies read access to the file"

I.e. the SecurityException SHOULD be thrown, if security manager is installed and there is no the appropriate file permission. That is not right. In fact, the SecurityException MAY BE thrown (and may be no). If the method does not try to access the file system, the exception is not thrown IRRESPECTIVE OF GRANTED FILE PERMISSIONS.

The specification should be clarified at this point.

For example, IOException has similar specific, but the specification still looks to be clear and accurate:

"Throws:
    IOException - If an I/O error occurs, which is possible because
        the construction of the canonical pathname may require
        filesystem queries"