This pull request fixes a number of security and functionality bugs in the new Utils.resolveURL method:
limit the number of redirects we are prepared to follow and detect redirection loops, so we can't get stuck in an infinite loop trying to resolve an un-resolveable URL
follow 303 and 307 redirects as well as 301/302
only allow redirects to other http or https URLs, do not follow things like http://malicious-server.com → file:/etc/shadow
added an overload that takes a URL object rather than a String, and if no redirections are required then return the exact passed-in URL object rather than creating a new one from the same URL string, and make DocumentImpl.init use this overload
this is critical for certain special cases like GCP input handlers where we override the URLStreamHandler for a document's sourceURL to read from a cached byte[]
This pull request fixes a number of security and functionality bugs in the new
Utils.resolveURLmethod:httporhttpsURLs, do not follow things likehttp://malicious-server.com→file:/etc/shadowURLobject rather than aString, and if no redirections are required then return the exact passed-in URL object rather than creating a new one from the same URL string, and makeDocumentImpl.inituse this overloadURLStreamHandlerfor a document'ssourceURLto read from a cachedbyte[]