There is no description for what "protocol" is. The most logical is that protocol is smth returned by codesource.getLocation().getProtocol(). If it so it's important to reflect this fact in documentation.




Note:

Let's look on the DOC:
If the protocol is not "file", then to connect to and accept connections from the URL's host is granted.

Consider next URL:
URL url = new URL("jar:file:///home/file.jar!");
This is a valid url refering to a jar file in the home directory. The url.getProtocol() returns "jar". So, according to documentation, permission to connect to and accept connections from the URL's host must be granted.

But real permission we need is a FilePermission to read the corresponding file.

Hence, may be "protocol" smth different, not simply codesource.getLocation().getProtocol()