fix: Normalize bare stylesheet paths to prevent MalformedURLException warnings (#24029)

Bare paths like "lumo/lumo.css" from @Stylesheet annotations cause a
MalformedURLException warning because ServletContext.getResource()
requires a leading '/'. Normalize the path in ResourceContentHash before
calling getStaticResource(), and document the '/' requirement in
VaadinService.getStaticResource() javadoc.

Fixes #24028

---------

Co-authored-by: Marco Collovati <marco@vaadin.com>

Author: Artur-

flow-server/src/main/java/com/vaadin/flow/internal/ResourceContentHash.java

@@ -17,6 +17,7 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.URI;
 import java.net.URL;
 import java.util.concurrent.ConcurrentHashMap;
 
@@ -98,13 +99,10 @@ private static String computeHash(VaadinService service,
     private static InputStream openResource(VaadinService service,
             String resourceUrl) {
         String resolved = service.resolveResource(resourceUrl);
-        URL url = service.getStaticResource(resolved);
-        // Bare paths (e.g. "styles.css") may not resolve in the servlet
-        // context which requires a leading '/'. Try with '/' prefix.
-        if (url == null && !resolved.startsWith("/")
-                && !resolved.contains("://")) {
-            url = service.getStaticResource("/" + resolved);
+        if (!resolved.startsWith("/") && !resolved.contains("://")) {
+            resolved = URI.create("/" + resolved).normalize().getPath();
         }
+        URL url = service.getStaticResource(resolved);
         if (url == null) {
             logger.debug(
                     "Could not find static resource for '{}' "

flow-server/src/main/java/com/vaadin/flow/server/VaadinService.java

@@ -2554,10 +2554,12 @@ public void fireUIInitListeners(UI ui) {
 
     /**
      * Returns a URL to the static resource at the given URI or null if no file
-     * found.
+     * found. The path must start with a {@code /} character for servlet-based
+     * implementations, as required by the Jakarta Servlet specification for
+     * {@code ServletContext.getResource()}.
      *
      * @param url
-     *            the URL for the resource
+     *            the URL for the resource, must start with {@code /}
      * @return the resource located at the named path, or <code>null</code> if
      *         there is no resource at that path
      */

flow-server/src/test/java/com/vaadin/flow/internal/ResourceContentHashTest.java

@@ -56,7 +56,7 @@ void getContentHash_knownContent_returnsExpectedHash() throws Exception {
         URL url = createTempResource("body { color: red; }");
         Mockito.when(service.resolveResource("styles.css"))
                 .thenReturn("styles.css");
-        Mockito.when(service.getStaticResource("styles.css")).thenReturn(url);
+        Mockito.when(service.getStaticResource("/styles.css")).thenReturn(url);
 
         String hash = ResourceContentHash.getContentHash(service, "styles.css");
 
@@ -100,19 +100,17 @@ void getContentHash_blankUrl_returnsNull() {
     void getContentHash_missingResource_returnsNull() {
         Mockito.when(service.resolveResource("missing.css"))
                 .thenReturn("missing.css");
-        Mockito.when(service.getStaticResource("missing.css")).thenReturn(null);
         Mockito.when(service.getStaticResource("/missing.css"))
                 .thenReturn(null);
 
         assertNull(ResourceContentHash.getContentHash(service, "missing.css"));
     }
 
     @Test
-    void getContentHash_barePath_fallsBackToSlashPrefixed() throws Exception {
+    void getContentHash_barePath_normalizedWithSlashPrefix() throws Exception {
         URL url = createTempResource("body { color: blue; }");
         Mockito.when(service.resolveResource("bare.css"))
                 .thenReturn("bare.css");
-        Mockito.when(service.getStaticResource("bare.css")).thenReturn(null);
         Mockito.when(service.getStaticResource("/bare.css")).thenReturn(url);
 
         String hash = ResourceContentHash.getContentHash(service, "bare.css");
@@ -125,7 +123,7 @@ void getContentHash_cachedAfterFirstCall() throws Exception {
         URL url = createTempResource("body {}");
         Mockito.when(service.resolveResource("cached.css"))
                 .thenReturn("cached.css");
-        Mockito.when(service.getStaticResource("cached.css")).thenReturn(url);
+        Mockito.when(service.getStaticResource("/cached.css")).thenReturn(url);
 
         String hash1 = ResourceContentHash.getContentHash(service,
                 "cached.css");
@@ -135,7 +133,7 @@ void getContentHash_cachedAfterFirstCall() throws Exception {
         assertEquals(hash1, hash2);
         // Resource URL should only be looked up once due to caching
         Mockito.verify(service, Mockito.times(1))
-                .getStaticResource("cached.css");
+                .getStaticResource("/cached.css");
     }
 
 }

flow-server/src/test/java/com/vaadin/flow/server/AppShellRegistryStyleSheetDataFilePathTest.java

@@ -108,14 +108,12 @@ void productionMode_hrefContainsHash_dataFilePathUnchanged()
         mocks.getDeploymentConfiguration().setProductionMode(true);
 
         // Register stylesheet resources so the hash can be computed.
-        // Paths must match what resolveResource() produces for each
-        // annotation value.
+        // Paths use leading '/' as required by ServletContext.getResource().
         mocks.getServlet().addServletContextResource("/absolute.css",
                 "body { color: red; }");
         mocks.getServlet().addServletContextResource("/from-context.css",
                 "body { color: blue; }");
-        // ./relative/path.css is passed through resolveResource unchanged
-        mocks.getServlet().addServletContextResource("./relative/path.css",
+        mocks.getServlet().addServletContextResource("/relative/path.css",
                 "body { color: green; }");
 
         AppShellRegistry registry = AppShellRegistry.getInstance(context);
@@ -170,8 +168,7 @@ void productionMode_hrefContainsHash_dataFilePathUnchanged()
     }
 
     @Test
-    void modifyIndex_customServletMapping_hrefIsServletRelative()
-            throws Exception {
+    void modifyIndex_customServletMapping_hrefIsServletRelative() {
         AppShellRegistry registry = AppShellRegistry.getInstance(context);
         registry.setShell(MyShell.class);
 
@@ -195,6 +192,70 @@ void modifyIndex_customServletMapping_hrefIsServletRelative()
                 links.get(3).attr("href"));
     }
 
+    @Test
+    void productionMode_modifyIndex_customServletMapping_hrefIsServletRelative() {
+
+        // Register stylesheet resources so the hash can be computed.
+        // Paths use leading '/' as required by ServletContext.getResource().
+        mocks.getServlet().addServletContextResource("/absolute.css",
+                "body { color: red; }");
+        mocks.getServlet().addServletContextResource("/from-context.css",
+                "body { color: blue; }");
+        mocks.getServlet().addServletContextResource("/relative/path.css",
+                "body { color: green; }");
+
+        Pattern hashPattern = Pattern
+                .compile("\\?" + ApplicationConstants.CONTENT_HASH_PARAMETER
+                        + "=[0-9a-f]{8}$");
+
+        mocks.getDeploymentConfiguration().setProductionMode(true);
+        AppShellRegistry registry = AppShellRegistry.getInstance(context);
+        registry.setShell(MyShell.class);
+
+        // Servlet mapped to "/myservlet/*", context path "/ctx".
+        // contextRootRelativePath becomes "./../" so relative and
+        // context:// hrefs must step one level up from the servlet path.
+        VaadinServletRequest request = createRequest("/", "/ctx", "/myservlet");
+        registry.modifyIndexHtml(document, request);
+
+        List<Element> links = document.head().select("link[rel=stylesheet]");
+        assertEquals(4, links.size());
+
+        // 1) Absolute path: href has hash appended, data-file-path unchanged
+        Element abs = links.get(0);
+        assertTrue(hashPattern.matcher(abs.attr("href")).find(),
+                "Absolute href should contain hash parameter");
+        assertTrue(abs.attr("href").startsWith("/absolute.css"),
+                "Absolute href should start with /absolute.css");
+        assertEquals("/absolute.css", abs.attr("data-file-path"));
+
+        // 2) Relative path: href is servlet-relative, hash appended,
+        // data-file-path unchanged
+        Element rel = links.get(1);
+        assertTrue(hashPattern.matcher(rel.attr("href")).find(),
+                "Relative href should contain hash parameter");
+        assertTrue(rel.attr("href").startsWith("./../relative/path.css"),
+                "Relative href should start with ./../");
+        assertEquals("./relative/path.css", rel.attr("data-file-path"));
+
+        // 3) Context path: href is servlet-relative (context:// expanded),
+        // hash appended, data-file-path unchanged
+        Element ctx = links.get(2);
+        assertTrue(hashPattern.matcher(ctx.attr("href")).find(),
+                "Context href should contain hash parameter");
+        assertTrue(ctx.attr("href").startsWith("./../from-context.css"),
+                "Context href should start with ./../");
+        assertEquals("context://from-context.css", ctx.attr("data-file-path"));
+
+        // 4) External URL: no hash appended, data-file-path unchanged
+        Element remote = links.get(3);
+        assertEquals("https://cdn.example.com/remote.css", remote.attr("href"));
+        assertFalse(hashPattern.matcher(remote.attr("href")).find(),
+                "External href should not have hash");
+        assertEquals("https://cdn.example.com/remote.css",
+                remote.attr("data-file-path"));
+    }
+
     @Test
     void productionMode_missingResource_fallsBackToOriginalUrl()
             throws Exception {

flow-server/src/test/java/com/vaadin/flow/server/communication/UidlWriterTest.java

@@ -353,11 +353,11 @@ void productionMode_stylesheetDependency_urlContainsHash()
         UI ui = initializeUIForDependenciesTest(new TestUI());
         mocks.getDeploymentConfiguration().setProductionMode(true);
 
-        // Add resources so hash can be computed. Paths must match what
-        // resolveResource() produces for the @StyleSheet annotation values.
-        mocks.getServlet().addServletContextResource("eager.css",
+        // Add resources so hash can be computed. Paths use leading '/' as
+        // required by ServletContext.getResource() per the servlet spec.
+        mocks.getServlet().addServletContextResource("/eager.css",
                 "body { color: red; }");
-        mocks.getServlet().addServletContextResource("lazy.css",
+        mocks.getServlet().addServletContextResource("/lazy.css",
                 "body { color: blue; }");
 
         UidlWriter uidlWriter = new UidlWriter();