avm2: Verify the URLRequest method

core/src/avm2/globals/flash/display/loader.rs

@@ -158,9 +158,8 @@ pub fn request_from_url_request<'gc>(
         string_headers.insert(name, value);
     }
 
-    // TODO: URLRequest.method should not be able to have invalid types.
-    // We should throw an error there on set.
-    let method = NavigationMethod::from_method_str(&method).unwrap_or(NavigationMethod::Get);
+    let method =
+        NavigationMethod::from_method_str(&method).expect("URLRequest should have a valid method");
     let data = url_request.get_public_property("data", activation)?;
     let body = match (method, data) {
         (_, Value::Null | Value::Undefined) => None,

core/src/avm2/globals/flash/net/URLRequest.as

@@ -10,7 +10,6 @@ package flash.net {
 		// FIXME - this should be a getter/setter for consistency with Flash
 		public var url:String;
 		private var _contentType: String = "application/x-www-form-urlencoded"; // ignored
-
 		private var _requestHeaders: Array = []; 
 
 		public var digest:String;
@@ -25,9 +24,14 @@ package flash.net {
 			return this._method;
 		}
 
-		public function set method(newMethod:String):void {
-			// FIXME - perform validation here
-			this._method = newMethod;
+		public function set method(value: String):void {
+			// The method can apparently either be all upper or lower case, but not mixed.
+			if (value !== "GET" && value !== "get" && value !== "POST" && value !== "post") {
+				throw new ArgumentError("Error #2008: Parameter method must be one of the accepted values.", 2008);
+			}
+
+			// TODO: AIR is supposed to support other methods like PUT or DELETE.
+			this._method = value;
 		}
 
 		public function get data():Object {