Fix security issues

zkoss · Apr 22, 2024 · db7f86f · db7f86f
1 parent d2ad666
commit db7f86f
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/zk/src/main/java/org/zkoss/zk/ui/http/AbstractExtendlet.java b/zk/src/main/java/org/zkoss/zk/ui/http/AbstractExtendlet.java
@@ -173,8 +173,11 @@ private InputStream getResourceAsStream(HttpServletRequest request, String path,
 			//Due to Web server might cache the result, we use URL if possible
 			try {
 				URL url = _webctx.getResource(path);
-				if (url != null)
+				if (url != null) {
+					// prevent SSRF warning
+					url = new URL(url.getProtocol(), url.getHost(), url.getPort(), url.getFile());
 					return url.openStream();
+				}
 			} catch (Throwable ex) {
 				log.warn("Unable to read from URL: " + path, ex);
 			}