FULL PRODUCT VERSION :
java version "1.6.0_20"
Java(TM) SE Runtime Environment (build 1.6.0_20-b02)
Java HotSpot(TM) Client VM (build 16.3-b01, mixed mode, sharing)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Version 5.1.2600]

A DESCRIPTION OF THE PROBLEM :
Drag and drop used from an unsigned applet fails under Java 6 update 20. The drop handler throws (java.security.AccessControlException: access denied (java.awt.AWTPermission accessClipboard)) on any attempt to call Transferable.getTransferData. Copy-paste works correctly, but a mouse-initiated drag (e.g. list, tree, etc) does not function correctly. This issue occurs under Windows XP, Vista, 7, and likely all other platforms (possibly part of a recent security patch in the plugin or JRE). This issue occurs only when using 1.6.0_20 and worked correctly under 1.6.0_19. The issue does not seem bound to a specific component type as components such as JTree, JList, etc, all will expose the incorrect behavior when they are the drag source.


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Create a simple drag source and drop target (e.g. list -> textbox) and create simple handlers. Enable dragging from the source. Implement a drop handler that accesses the Transferable and attempts to get the data using a valid flavor. Place these graphical components into an applet and host the applet via HTML as an unsigned applet.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The drop succeeds, running any code after the call to Transferable.getTransferData.
ACTUAL -
The call to Transferable.getTransferData throws java.security.AccessControlException: access denied (java.awt.AWTPermission accessClipboard).

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "AWT-EventQueue-2" java.security.AccessControlException: access denied (java.awt.AWTPermission accessClipboard)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkSystemClipboardAccess(Unknown Source)
at sun.awt.dnd.SunDropTargetContextPeer.getTransferData(Unknown Source)
at sun.awt.datatransfer.TransferableProxy.getTransferData(Unknown Source)
at java.awt.dnd.DropTargetContext$TransferableProxy.getTransferData(Unknown Source)
at com.AppletPie$1$2.importData(AppletPie.java:47)
at javax.swing.TransferHandler$DropHandler.drop(Unknown Source)
at java.awt.dnd.DropTarget.drop(Unknown Source)
at javax.swing.TransferHandler$SwingDropTarget.drop(Unknown Source)
at sun.awt.dnd.SunDropTargetContextPeer.processDropMessage(Unknown Source)
at sun.awt.dnd.SunDropTargetContextPeer$EventDispatcher.dispatchDropEvent(Unknown Source)
at sun.awt.dnd.SunDropTargetContextPeer$EventDispatcher.dispatchEvent(Unknown Source)
at sun.awt.dnd.SunDropTargetEvent.dispatch(Unknown Source)
at java.awt.Component.dispatchEventImpl(Unknown Source)
at java.awt.Container.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.LightweightDispatcher.retargetMouseEvent(Unknown Source)
at java.awt.LightweightDispatcher.processDropTargetEvent(Unknown Source)
at java.awt.LightweightDispatcher.dispatchEvent(Unknown Source)
at java.awt.Container.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.EventQueue.dispatchEvent(Unknown Source)
at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.run(Unknown Source)


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import java.awt.Container;
import java.awt.GridLayout;
import java.awt.datatransfer.*;

import javax.swing.*;
import javax.swing.TransferHandler;
import javax.swing.TransferHandler.TransferSupport;

public class AppletPie
   extends JApplet
{
   public void init() {
      Runnable runnable = new Runnable()
      {
         public void run() {
            Container cp = getContentPane();
            cp.setLayout(new GridLayout(1, 2));

            // source of drag irrelevant
            final JList list = new JList(new String[] {"one", "two", "three"});
            cp.add(new JScrollPane(list));
            list.setDragEnabled(true);

            final JTextArea textArea = new JTextArea("Some text");
            cp.add(new JScrollPane(textArea));

            list.setTransferHandler(new TransferHandler()
            {
               protected Transferable createTransferable(JComponent c) {
                  // other drag sources cause same issue
                  return new StringSelection(String.valueOf(list.getSelectedValue()));
               }
               public int getSourceActions(JComponent c) {
                  return COPY;
               }
            });
            textArea.setTransferHandler(new TransferHandler()
            {
               public boolean canImport(TransferSupport support) {
                  return support.isDataFlavorSupported(DataFlavor.stringFlavor);
               }
               public boolean importData(TransferSupport support) {
                  try {
                     // java.security.AccessControlException: access denied (java.awt.AWTPermission accessClipboard)
                     String path = (String) support.getTransferable().getTransferData(DataFlavor.stringFlavor);
                     textArea.setText(String.valueOf(path));
                     return true;
                  } catch (Exception ex) {
                     ex.printStackTrace();
                  }
                  return false;
               }
            });
         }
      };
      if (SwingUtilities.isEventDispatchThread()) {
         runnable.run();
      } else {
         try {
            SwingUtilities.invokeAndWait(runnable);
         } catch (Exception ex) {
            ex.printStackTrace();
         }
      }
   }
}
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Add permission to policy file: permission java.awt.AWTPermission "accessClipboard";
This is not a good workaround as it opens a security hole.

Release Regression From : 6u19
The above release value was the last known release where this
bug was not reproducible. Since then there has been a regression.