do not load local files for async xhr if file protocol is not allowed

src/changes/changes.xml

@@ -8,6 +8,10 @@
 
     <body>
         <release version="5.8.0" date="xxxx xx, 2026" description="Bugfixes">
+            <action type="fix" dev="Vidya m">
+                XMLHttpRequest: asynchronous requests to file: urls no longer load the file if
+                WebClientOptions.isFileProtocolForXMLHttpRequestsAllowed() is false.
+            </action>
             <action type="fix" dev="rbri" issue="#722">
                 KeyboardEvent: key, code and location are now correct for special keys (arrows, navigation,
                 function keys, numpad, modifiers, ...) and the code is correct for digits, space and punctuation.

src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java

@@ -998,13 +998,13 @@ void doSend() {
                 fireJavascriptEvent(Event.TYPE_READY_STATE_CHANGE);
                 fireJavascriptEvent(Event.TYPE_ERROR);
                 fireJavascriptEvent(Event.TYPE_LOAD_END);
+                return;
             }
-            else {
-                throw JavaScriptEngine.asJavaScriptException(
-                        window,
-                        "Not allowed to load local resource: " + webRequest_.getUrl(),
-                        DOMException.NETWORK_ERR);
-            }
+
+            throw JavaScriptEngine.asJavaScriptException(
+                    window,
+                    "Not allowed to load local resource: " + webRequest_.getUrl(),
+                    DOMException.NETWORK_ERR);
         }
 
         final BrowserVersion browserVersion = getBrowserVersion();

src/test/java/org/htmlunit/javascript/host/xml/XMLHttpRequest4Test.java

@@ -217,4 +217,21 @@ public void sendLocalSubFileAllowed() throws Exception {
         assertEquals(0, client.waitForBackgroundJavaScriptStartingBefore(1000));
         assertEquals(getExpectedAlerts()[0], page.getTitleText());
     }
+
+    /**
+     * @throws Exception if the test fails
+     */
+    @Test
+    @Alerts("readystatechange§1§0§readystatechange§4§0§error§")
+    public void sendLocalFileAsyncNotAllowed() throws Exception {
+        final URL fileURL = getClass().getClassLoader().getResource("testfiles/localxmlhttprequest/index_async.html");
+        final File file = new File(fileURL.toURI());
+        assertTrue("File '" + file.getAbsolutePath() + "' does not exist", file.exists());
+
+        final WebClient client = getWebClient();
+        final HtmlPage page = client.getPage(fileURL);
+
+        assertEquals(0, client.waitForBackgroundJavaScriptStartingBefore(1000));
+        assertEquals(getExpectedAlerts()[0], page.getTitleText());
+    }
 }

src/test/resources/testfiles/localxmlhttprequest/index_async.html

@@ -0,0 +1,23 @@
+<html>
+<head><script>
+  function log(msg) { window.document.title += msg + '\u00a7'; }
+  function test() {
+    try {
+      var xhr = new XMLHttpRequest();
+      xhr.onreadystatechange = function(event) {
+                    log(event.type);
+                    log(xhr.readyState);
+                    log(xhr.responseText.length);
+                  };
+      xhr.onerror = function(event) {
+                    log(event.type);
+                  };
+      xhr.open('GET', 'index_async.html', true);
+      xhr.send('');
+  } catch (exception) { 
+    log(exception.name);
+  }
+}
+</script></head>
+<body onload='test()'>
+</body></html>