import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.net.URI;
import java.net.URL;
import java.net.URLClassLoader;

public class URLClassLoaderSSRF extends HttpServlet {

    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            String url = request.getParameter("uri");
            URI uri = new URI(url);
            URLClassLoader urlClassLoader = new URLClassLoader(new URL[]{uri.toURL()}); // $ SSRF
            Class<?> test = urlClassLoader.loadClass("test");
        } catch (Exception e) {
            // Ignore
        }
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            String url = request.getParameter("uri");
            URI uri = new URI(url);
            URLClassLoader urlClassLoader = new URLClassLoader(new URL[]{uri.toURL()}, URLClassLoaderSSRF.class.getClassLoader()); // $ SSRF
            Class<?> test = urlClassLoader.loadClass("test");
        } catch (Exception e) {
            // Ignore
        }
    }

    protected void doPut(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            String url = request.getParameter("uri");
            URI uri = new URI(url);

            URLStreamHandlerFactory urlStreamHandlerFactory = TomcatURLStreamHandlerFactory.getInstance();
            URLClassLoader urlClassLoader = new URLClassLoader(new URL[]{uri.toURL()}, URLClassLoaderSSRF.class.getClassLoader(), urlStreamHandlerFactory); // $ SSRF
            urlClassLoader.findResource("test");
        } catch (Exception e) {
            // Ignore
        }
    }

    protected void doDelete(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            String url = request.getParameter("uri");
            URI uri = new URI(url);
            URLClassLoader urlClassLoader = URLClassLoader.newInstance(new URL[]{uri.toURL()}); // $ SSRF
            urlClassLoader.getResourceAsStream("test");
        } catch (Exception e) {
            // Ignore
        }
    }

    protected void doOptions(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            String url = request.getParameter("uri");
            URI uri = new URI(url);
            URLClassLoader urlClassLoader = 
                new URLClassLoader("testClassLoader", 
                    new URL[]{new URL[]{uri.toURL()}}, 
                    URLClassLoaderSSRF.class.getClassLoader()
                ); // $ SSRF

            Class<?> rceTest = urlClassLoader.loadClass("RCETest");
        } catch (Exception e) {
            // Ignore
        }
    }

    protected void doTrace(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            String url = request.getParameter("uri");
            URI uri = new URI(url);
            URLStreamHandlerFactory urlStreamHandlerFactory = TomcatURLStreamHandlerFactory.getInstance();

            URLClassLoader urlClassLoader =
                new URLClassLoader("testClassLoader",
                    new URL[]{uri.toURL()}, 
                    URLClassLoaderSSRF.class.getClassLoader(), 
                    urlStreamHandlerFactory
                ); // $ SSRF

            Class<?> rceTest = urlClassLoader.loadClass("RCETest");
        } catch (Exception e) {
            // Ignore
        }
    }
}
@@ -265,16 +265,57 @@
 sLoader;
+%0Aimport java.net.URLStreamHandlerFactory;
 %0A%0Apublic
@@ -1650,51 +1650,12 @@
 y = 
-TomcatURLStreamHandlerFactory.getInstance()
+null
 ;%0A  
@@ -2697,17 +2697,16 @@
 Loader =
- 
 %0A       
@@ -2751,17 +2751,16 @@
 Loader%22,
- 
 %0A       
@@ -2780,18 +2780,8 @@
 new 
-URL%5B%5D%7Bnew 
 URL%5B
@@ -2794,19 +2794,27 @@
 toURL()%7D
-%7D
 , 
+// $ SSRF
 %0A       
@@ -2882,34 +2882,24 @@
           );
- // $ SSRF
 %0A%0A          
@@ -3333,51 +3333,12 @@
 y = 
-TomcatURLStreamHandlerFactory.getInstance()
+null
 ;%0A%0A 
@@ -3478,16 +3478,25 @@
 URL()%7D, 
+// $ SSRF
 %0A       
@@ -3550,17 +3550,16 @@
 oader(),
- 
 %0A       
@@ -3613,26 +3613,16 @@
       );
- // $ SSRF
 %0A%0A      

Fix URLClassLoader test