From 47f2ecc49ba5592b87c0ab0534510eb4a907fde1 Mon Sep 17 00:00:00 2001
From: Vidya m <vidya@labs.digiscrypt.com>
Date: Wed, 28 Oct 2026 22:29:41 +0530
Subject: [PATCH 1/2] do not load local files for async xhr if file protocol is
 not allowed

---
 .../javascript/host/xml/XMLHttpRequest.java   |  1 +
 .../host/xml/XMLHttpRequest4Test.java         | 17 ++++++++++++++
 .../localxmlhttprequest/index_async.html      | 23 +++++++++++++++++++
 3 files changed, 41 insertions(+)
 create mode 100644 src/test/resources/testfiles/localxmlhttprequest/index_async.html

diff --git a/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java b/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
index b28b869d783..ec2f7c65e6a 100644
--- a/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
+++ b/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
@@ -998,6 +998,7 @@ void doSend() {
                 fireJavascriptEvent(Event.TYPE_READY_STATE_CHANGE);
                 fireJavascriptEvent(Event.TYPE_ERROR);
                 fireJavascriptEvent(Event.TYPE_LOAD_END);
+                return;
             }
             else {
                 throw JavaScriptEngine.asJavaScriptException(
diff --git a/src/test/java/org/htmlunit/javascript/host/xml/XMLHttpRequest4Test.java b/src/test/java/org/htmlunit/javascript/host/xml/XMLHttpRequest4Test.java
index 2f972de9cad..6a1d570ebd6 100644
--- a/src/test/java/org/htmlunit/javascript/host/xml/XMLHttpRequest4Test.java
+++ b/src/test/java/org/htmlunit/javascript/host/xml/XMLHttpRequest4Test.java
@@ -217,4 +217,21 @@ public void sendLocalSubFileAllowed() throws Exception {
         assertEquals(0, client.waitForBackgroundJavaScriptStartingBefore(1000));
         assertEquals(getExpectedAlerts()[0], page.getTitleText());
     }
+
+    /**
+     * @throws Exception if the test fails
+     */
+    @Test
+    @Alerts("readystatechange§1§0§readystatechange§4§0§error§")
+    public void sendLocalFileAsyncNotAllowed() throws Exception {
+        final URL fileURL = getClass().getClassLoader().getResource("testfiles/localxmlhttprequest/index_async.html");
+        final File file = new File(fileURL.toURI());
+        assertTrue("File '" + file.getAbsolutePath() + "' does not exist", file.exists());
+
+        final WebClient client = getWebClient();
+        final HtmlPage page = client.getPage(fileURL);
+
+        assertEquals(0, client.waitForBackgroundJavaScriptStartingBefore(1000));
+        assertEquals(getExpectedAlerts()[0], page.getTitleText());
+    }
 }
diff --git a/src/test/resources/testfiles/localxmlhttprequest/index_async.html b/src/test/resources/testfiles/localxmlhttprequest/index_async.html
new file mode 100644
index 00000000000..50490628d8a
--- /dev/null
+++ b/src/test/resources/testfiles/localxmlhttprequest/index_async.html
@@ -0,0 +1,23 @@
+<html>
+<head><script>
+  function log(msg) { window.document.title += msg + '\u00a7'; }
+  function test() {
+    try {
+      var xhr = new XMLHttpRequest();
+      xhr.onreadystatechange = function(event) {
+                    log(event.type);
+                    log(xhr.readyState);
+                    log(xhr.responseText.length);
+                  };
+      xhr.onerror = function(event) {
+                    log(event.type);
+                  };
+      xhr.open('GET', 'index_async.html', true);
+      xhr.send('');
+  } catch (exception) { 
+    log(exception.name);
+  }
+}
+</script></head>
+<body onload='test()'>
+</body></html>

From d3ceac07a212cd5bb92bd2d26a0d8620e3395530 Mon Sep 17 00:00:00 2001
From: Vidya m <vidya@labs.digiscrypt.com>
Date: Fri, 6 Nov 2026 13:41:28 +0530
Subject: [PATCH 2/2] Drop redundant else in local file check, add changes.xml
 entry

---
 src/changes/changes.xml                               |  4 ++++
 .../htmlunit/javascript/host/xml/XMLHttpRequest.java  | 11 +++++------
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 9ad62f4e274..a65f398e5a4 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -8,6 +8,10 @@
 
     <body>
         <release version="5.8.0" date="xxxx xx, 2026" description="Bugfixes">
+            <action type="fix" dev="Vidya m">
+                XMLHttpRequest: asynchronous requests to file: urls no longer load the file if
+                WebClientOptions.isFileProtocolForXMLHttpRequestsAllowed() is false.
+            </action>
             <action type="fix" dev="rbri" issue="#722">
                 KeyboardEvent: key, code and location are now correct for special keys (arrows, navigation,
                 function keys, numpad, modifiers, ...) and the code is correct for digits, space and punctuation.
diff --git a/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java b/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
index ec2f7c65e6a..040a8f51154 100644
--- a/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
+++ b/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
@@ -1000,12 +1000,11 @@ void doSend() {
                 fireJavascriptEvent(Event.TYPE_LOAD_END);
                 return;
             }
-            else {
-                throw JavaScriptEngine.asJavaScriptException(
-                        window,
-                        "Not allowed to load local resource: " + webRequest_.getUrl(),
-                        DOMException.NETWORK_ERR);
-            }
+
+            throw JavaScriptEngine.asJavaScriptException(
+                    window,
+                    "Not allowed to load local resource: " + webRequest_.getUrl(),
+                    DOMException.NETWORK_ERR);
         }
 
         final BrowserVersion browserVersion = getBrowserVersion();