IssueTracker

* Which Developer Preview build are you using? See Settings > About phone > Build number (for example OPP5.170921.005).
    * What device are you using? (for example, Pixel XL)

PPP1.180208.014 (Pixel)

    * What are the steps to reproduce the problem? (Please provide the minimal reproducible test case.)

Step #1: Read https://developer.android.com/preview/features/security-behav.html#tls-enabled

Step #2: Download https://commonsware.com/misc/google-bugs/HURLSecure-20180310.zip

Step #3: Install and run that project, which uses HttpURLConnection to download the content located at a plain HTTP URL

    * Issue Category e.g. Framework (platform), NDK (platform), Hardware (CPU, GPU, Sensor, Camera), ART (platform), Runtime Permissions etc

Framework?

    * What was the expected result?

A crash, with LogCat showing a stack trace indicating that I cannot download this, because it is in cleartext, as this project has targetSdkVersion 'P', and cleartext traffic is not supposed to be allowed by default

    * What was the actual result?

The content is downloaded just fine.

If you modify the project to include a network security configuration with cleartextTrafficPermitted="false", then you get the expected crash:

Exception trying to download content
 java.io.IOException: Cleartext HTTP traffic to wares-nossl.commonsware.com not permitted
     at com.android.okhttp.HttpHandler$CleartextURLFilter.checkURLPermitted(HttpHandler.java:115)
     at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:458)
     at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:407)
     at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:244)
     at com.commonsware.android.hurl.secure.DownloadThread.run(DownloadThread.java:31)

However, according to the documentation, this crash is supposed to be happening by default.