Skip to content

do not load local files for async xhr if file protocol is not allowed - #1185

Open
Vidya-m78 wants to merge 1 commit into
HtmlUnit:masterfrom
Vidya-m78:xhr-async-local-file-check
Open

Vidya-m78 wants to merge 1 commit into
HtmlUnit:masterfrom
Vidya-m78:xhr-async-local-file-check

Conversation

@Vidya-m78

Copy link
Copy Markdown
Contributor

Async XMLHttpRequest ignores the local resource check
When isFileProtocolForXMLHttpRequestsAllowed() is false (the default), doSend() throws for a sync request to a file: url, but for an async request it only fires readystatechange/error/loadend and then falls through to the normal send. The file is loaded anyway and the page gets readyState 2/3/4 with the full responseText, so a page opened from disk can read any other local file. sendLocalFileAsyncNotAllowed fails on master (629 bytes of the file are returned after the error event) and passes with the added return.

@sonarqubecloud

sonarqubecloud Bot commented Nov 3, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

fireJavascriptEvent(Event.TYPE_LOAD_END);
return;
}
else {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lets drop the else, we have the return

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to be clear, only the else not the whole throw ;-)

@rbri

rbri commented Nov 3, 2026

Copy link
Copy Markdown
Member

maybe you can also a an entry to the changes.xml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants