Fix URLClassLoader test

Author: smowton

java/ql/test/query-tests/security/CWE-918/URLClassLoaderSSRF.java

@@ -6,6 +6,7 @@
 import java.net.URI;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.net.URLStreamHandlerFactory;
 
 public class URLClassLoaderSSRF extends HttpServlet {
 
@@ -39,7 +40,7 @@ protected void doPut(HttpServletRequest request, HttpServletResponse response)
             String url = request.getParameter("uri");
             URI uri = new URI(url);
 
-            URLStreamHandlerFactory urlStreamHandlerFactory = TomcatURLStreamHandlerFactory.getInstance();
+            URLStreamHandlerFactory urlStreamHandlerFactory = null;
             URLClassLoader urlClassLoader = new URLClassLoader(new URL[]{uri.toURL()}, URLClassLoaderSSRF.class.getClassLoader(), urlStreamHandlerFactory); // $ SSRF
             urlClassLoader.findResource("test");
         } catch (Exception e) {
@@ -64,11 +65,11 @@ protected void doOptions(HttpServletRequest request, HttpServletResponse respons
         try {
             String url = request.getParameter("uri");
             URI uri = new URI(url);
-            URLClassLoader urlClassLoader = 
-                new URLClassLoader("testClassLoader", 
-                    new URL[]{new URL[]{uri.toURL()}}, 
+            URLClassLoader urlClassLoader =
+                new URLClassLoader("testClassLoader",
+                    new URL[]{uri.toURL()}, // $ SSRF
                     URLClassLoaderSSRF.class.getClassLoader()
-                ); // $ SSRF
+                );
 
             Class<?> rceTest = urlClassLoader.loadClass("RCETest");
         } catch (Exception e) {
@@ -81,14 +82,14 @@ protected void doTrace(HttpServletRequest request, HttpServletResponse response)
         try {
             String url = request.getParameter("uri");
             URI uri = new URI(url);
-            URLStreamHandlerFactory urlStreamHandlerFactory = TomcatURLStreamHandlerFactory.getInstance();
+            URLStreamHandlerFactory urlStreamHandlerFactory = null;
 
             URLClassLoader urlClassLoader =
                 new URLClassLoader("testClassLoader",
-                    new URL[]{uri.toURL()}, 
-                    URLClassLoaderSSRF.class.getClassLoader(), 
+                    new URL[]{uri.toURL()}, // $ SSRF
+                    URLClassLoaderSSRF.class.getClassLoader(),
                     urlStreamHandlerFactory
-                ); // $ SSRF
+                );
 
             Class<?> rceTest = urlClassLoader.loadClass("RCETest");
         } catch (Exception e) {