From 93aea33cf50289240835fbcccc4365c7800536d9 Mon Sep 17 00:00:00 2001
From: Bauke Scholtz <balusc@gmail.com>
Date: Sun, 24 Mar 2024 11:15:31 -0400
Subject: [PATCH] Fix #5414 only http/2-push real faces resource urls coming
 from resource components/annotations and thus not just any url which happens
 to be passed through encodeResourceURL

---
 .../faces/context/ExternalContextImpl.java    | 47 +++++++++----------
 1 file changed, 23 insertions(+), 24 deletions(-)

diff --git a/impl/src/main/java/com/sun/faces/context/ExternalContextImpl.java b/impl/src/main/java/com/sun/faces/context/ExternalContextImpl.java
index 935754bf91..d75b6f2032 100644
--- a/impl/src/main/java/com/sun/faces/context/ExternalContextImpl.java
+++ b/impl/src/main/java/com/sun/faces/context/ExternalContextImpl.java
@@ -42,16 +42,6 @@
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
-import com.sun.faces.RIConstants;
-import com.sun.faces.config.WebConfiguration;
-import com.sun.faces.context.flash.ELFlash;
-import com.sun.faces.renderkit.html_basic.ScriptRenderer;
-import com.sun.faces.renderkit.html_basic.StylesheetRenderer;
-import com.sun.faces.util.FacesLogger;
-import com.sun.faces.util.MessageUtils;
-import com.sun.faces.util.TypedCollections;
-import com.sun.faces.util.Util;
-
 import jakarta.faces.FacesException;
 import jakarta.faces.FactoryFinder;
 import jakarta.faces.application.ProjectStage;
@@ -74,6 +64,16 @@
 import jakarta.servlet.http.HttpSession;
 import jakarta.servlet.http.PushBuilder;
 
+import com.sun.faces.RIConstants;
+import com.sun.faces.config.WebConfiguration;
+import com.sun.faces.context.flash.ELFlash;
+import com.sun.faces.renderkit.html_basic.ScriptRenderer;
+import com.sun.faces.renderkit.html_basic.StylesheetRenderer;
+import com.sun.faces.util.FacesLogger;
+import com.sun.faces.util.MessageUtils;
+import com.sun.faces.util.TypedCollections;
+import com.sun.faces.util.Util;
+
 /**
  * <p>
  * This implementation of {@link ExternalContext} is specific to the servlet implementation.
@@ -576,10 +576,10 @@ public String encodeResourceURL(String url) {
             throw new NullPointerException(getExceptionMessageString(NULL_PARAMETERS_ERROR_MESSAGE_ID, "url"));
         }
 
-        String result = ((HttpServletResponse) response).encodeURL(url);
-        pushIfPossibleAndNecessary(result);
+        String encodedURL = ((HttpServletResponse) response).encodeURL(url);
+        pushIfPossibleAndNecessary(encodedURL);
 
-        return result;
+        return encodedURL;
     }
 
     /**
@@ -1032,26 +1032,25 @@ public void release() {
         flash = null;
     }
 
-    private void pushIfPossibleAndNecessary(String result) {
+    @SuppressWarnings("unchecked")
+    private void pushIfPossibleAndNecessary(String encodedURL) {
         FacesContext context = FacesContext.getCurrentInstance();
 
-        // 1. Don't bother trying to push if we've already pushed this URL for this request
-        @SuppressWarnings("unchecked")
-        Set<String> resourceUrls = (Set<String>) context.getAttributes().computeIfAbsent(PUSH_RESOURCE_URLS_KEY_NAME,
-                k -> new HashSet<>());
+        if (!context.getApplication().getResourceHandler().isResourceURL(encodedURL)) {
+            return;
+        }
+
+        Set<String> resourceUrls = (Set<String>) context.getAttributes().computeIfAbsent(PUSH_RESOURCE_URLS_KEY_NAME, k -> new HashSet<>());
 
-        if (resourceUrls.contains(result)) {
+        if (!resourceUrls.add(encodedURL)) {
             return;
         }
-        resourceUrls.add(result);
 
-        // 2. At this point we know we haven't pushed this URL for this request before
         PushBuilder pushBuilder = getPushBuilder(context);
+
         if (pushBuilder != null) {
-            // and now we also know there was no If-Modified-Since header
-            pushBuilder.path(result).push();
+            pushBuilder.path(encodedURL).push();
         }
-
     }
 
     private PushBuilder getPushBuilder(FacesContext context) {