FULL PRODUCT VERSION :
java version "1.8.0_11"
Java(TM) SE Runtime Environment (build 1.8.0_11-b12)
Java HotSpot(TM) Client VM (build 25.11-b03, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.1.7601]

A DESCRIPTION OF THE PROBLEM :
I have a JNLP file that worked fine with Java 7u60 and previous and Java 8u5 and previous. Since the latest update Java7u65 and Java8u11 the app fails to launch. I have enabled full logging in the Java Console and received the following message:
security: Rejecting argument with illegal chars: http://www.somewebsitehere.com/path/path%20with%20spaces/

REGRESSION. Last worked in version 8u11

ADDITIONAL REGRESSION INFORMATION:
java version "1.8.0_11"
Java(TM) SE Runtime Environment (build 1.8.0_11-b12)
Java HotSpot(TM) Client VM (build 25.11-b03, mixed mode)

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. Create a JNLP file that contains an href URL with an escaped character for a space, %20.
2. Try to launch the JNLP and it will error out because while parsing the JNLP it has removed the href with the % symbol in it.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
I expected the application to launch.
ACTUAL -
Received an error message saying the href value was required for an element in the JNLP file when I already had a value there.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
security: Rejecting argument with illegal chars: http://www.somewebsitehere.com/path/path%20with%20spaces/

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
I cannot provide source code since the problem is in the XMLParser.parseXMLAttribute function of the com.sun.deploy.xml package. It now calls the Config.isLegalArgument on the href contents and that function marks a % symbol as an invalid argument even though it is a valid character in a URL.
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
The only workaround is to remove the space from the URL but that requires changing the entire file structure of the website.