The constructor of SocketPermission(String host, String action) expects the action argument to be a comma-separated list of possible actions, like connect, accept, listen, resolve.
The string must contain at least one action and is allowed to contain white spaces, which are ignored.

It turns out that if the string is immediately started with a comma, the argument is parsed Okay.

new SocketPermission("localhost", " , connect, accept"); <<-- throws IllegalArgumentException: invalid permission: , connect, accept

new SocketPermission("localhost", ", connect, accept"); <<-- does not throw

It would be better to make parsing more consistent.

Also, it may be a good idea to update the javadoc and specify the possible exceptions to be thrown.