This CR is follow up on CR 6420327.

Let's take a look at following use case:

(new URL(urlString)).openConnection().getInputStream()

SecurityException is not mentioned neither in URL.openConnection() nor in URLCOnnection.getInputStream() javadoc.

I see that in general it is responsibility of protocol handler to make security checks.
However accordingly with URL class spec support for some protocols is mandatory. It means that protocol handlers for these protocols are part of Java implementation.

So it would be correct and quite nice to say add SecurityException clause under "Throws" subtitle and specify condition when it is thrown by protocol handlers provided by Java implementation (http, https, ftp, file, and jar).