From 25376907562495ae28922c89886e15bf9911ef06 Mon Sep 17 00:00:00 2001
From: Nihal Jain <nihaljain@apache.org>
Date: Tue, 10 Sep 2024 21:39:40 +0530
Subject: [PATCH] HBASE-28070 Replace javax.servlet.jsp dependency with
 tomcat-jasper (#6218) (#5607)

- Also handle changes required for hadoop-2 assembly

Signed-off-by: Istvan Toth <stoty@apache.org>
Signed-off-by: Nick Dimiduk <ndimiduk@apache.org>
(cherry picked from commit b6394b1f6420d2374790fb0aad48cc736ed9999c)
---
 hbase-assembly/src/main/assembly/client.xml   |  5 +++
 .../src/main/assembly/hadoop-three-compat.xml |  5 +++
 .../src/main/assembly/hadoop-two-compat.xml   |  5 +++
 .../main/resources/supplemental-models.xml    | 39 -------------------
 hbase-rest/pom.xml                            | 11 +-----
 hbase-server/pom.xml                          |  4 +-
 hbase-shaded/hbase-shaded-mapreduce/pom.xml   |  4 +-
 hbase-thrift/pom.xml                          | 11 +-----
 pom.xml                                       | 28 ++++++++-----
 9 files changed, 41 insertions(+), 71 deletions(-)

diff --git a/hbase-assembly/src/main/assembly/client.xml b/hbase-assembly/src/main/assembly/client.xml
index 54ed2e96fdd8..e9e23d2b2f67 100644
--- a/hbase-assembly/src/main/assembly/client.xml
+++ b/hbase-assembly/src/main/assembly/client.xml
@@ -66,6 +66,11 @@
               <exclude>io.opentelemetry.javaagent:*</exclude>
               <exclude>org.hamcrest:hamcrest-core</exclude>
               <exclude>org.mockito:mockito-core</exclude>
+              <!-- Exclude transitive dependencies of tomcat-jasper, not needed at runtime -->
+              <exclude>org.apache.tomcat:tomcat-juli</exclude>
+              <exclude>org.apache.tomcat:tomcat-api</exclude>
+              <exclude>org.apache.tomcat:tomcat-util-scan</exclude>
+              <exclude>org.apache.tomcat:tomcat-util</exclude>
             </excludes>
           </dependencySet>
         </dependencySets>
diff --git a/hbase-assembly/src/main/assembly/hadoop-three-compat.xml b/hbase-assembly/src/main/assembly/hadoop-three-compat.xml
index 771704d6e1df..b25fc31c5e61 100644
--- a/hbase-assembly/src/main/assembly/hadoop-three-compat.xml
+++ b/hbase-assembly/src/main/assembly/hadoop-three-compat.xml
@@ -113,6 +113,11 @@
               <exclude>junit:junit</exclude>
               <exclude>org.hamcrest:hamcrest-core</exclude>
               <exclude>org.mockito:mockito-core</exclude>
+              <!-- Exclude transitive dependencies of tomcat-jasper, not needed at runtime -->
+              <exclude>org.apache.tomcat:tomcat-juli</exclude>
+              <exclude>org.apache.tomcat:tomcat-api</exclude>
+              <exclude>org.apache.tomcat:tomcat-util-scan</exclude>
+              <exclude>org.apache.tomcat:tomcat-util</exclude>
             </excludes>
           </dependencySet>
         </dependencySets>
diff --git a/hbase-assembly/src/main/assembly/hadoop-two-compat.xml b/hbase-assembly/src/main/assembly/hadoop-two-compat.xml
index 1a733c600ba6..f79279d0a46a 100644
--- a/hbase-assembly/src/main/assembly/hadoop-two-compat.xml
+++ b/hbase-assembly/src/main/assembly/hadoop-two-compat.xml
@@ -113,6 +113,11 @@
               <exclude>org.slf4j:*</exclude>
               <exclude>org.apache.logging.log4j:*</exclude>
               <exclude>io.opentelemetry.javaagent:*</exclude>
+              <!-- Exclude transitive dependencies of tomcat-jasper, not needed at runtime -->
+              <exclude>org.apache.tomcat:tomcat-juli</exclude>
+              <exclude>org.apache.tomcat:tomcat-api</exclude>
+              <exclude>org.apache.tomcat:tomcat-util-scan</exclude>
+              <exclude>org.apache.tomcat:tomcat-util</exclude>
             </excludes>
           </dependencySet>
         </dependencySets>
diff --git a/hbase-resource-bundle/src/main/resources/supplemental-models.xml b/hbase-resource-bundle/src/main/resources/supplemental-models.xml
index 54785976e6ff..624b0ea8e38b 100644
--- a/hbase-resource-bundle/src/main/resources/supplemental-models.xml
+++ b/hbase-resource-bundle/src/main/resources/supplemental-models.xml
@@ -348,19 +348,6 @@ under the License.
       </licenses>
     </project>
   </supplement>
-  <supplement>
-    <project>
-      <groupId>org.glassfish</groupId>
-      <artifactId>javax.el</artifactId>
-      <licenses>
-        <license>
-          <name>CDDL 1.1</name>
-          <url>https://glassfish.java.net/public/CDDL+GPL_1_1.html</url>
-          <distribution>repo</distribution>
-        </license>
-      </licenses>
-    </project>
-  </supplement>
   <supplement>
     <project>
       <groupId>org.glassfish.hk2</groupId>
@@ -530,32 +517,6 @@ under the License.
       </licenses>
     </project>
   </supplement>
-  <supplement>
-    <project>
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp</artifactId>
-      <licenses>
-        <license>
-          <name>CDDL 1.1</name>
-          <url>https://glassfish.java.net/public/CDDL+GPL_1_1.html</url>
-          <distribution>repo</distribution>
-        </license>
-      </licenses>
-    </project>
-  </supplement>
-  <supplement>
-    <project>
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp.jstl</artifactId>
-      <licenses>
-        <license>
-          <name>CDDL 1.1</name>
-          <url>https://glassfish.java.net/public/CDDL+GPL_1_1.html</url>
-          <distribution>repo</distribution>
-        </license>
-      </licenses>
-    </project>
-  </supplement>
   <supplement>
     <project>
       <groupId>javax.validation</groupId>
diff --git a/hbase-rest/pom.xml b/hbase-rest/pom.xml
index bc8bb065071c..4b6067f4af8e 100644
--- a/hbase-rest/pom.xml
+++ b/hbase-rest/pom.xml
@@ -191,15 +191,8 @@
     </dependency>
     <dependency>
       <!--For JspC used in ant task-->
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp</artifactId>
-    </dependency>
-    <!-- Specifically needed for jetty-jsp, included
-         to bypass version scanning that hits a bad repo
-         see HBASE-18831 -->
-    <dependency>
-      <groupId>org.glassfish</groupId>
-      <artifactId>javax.el</artifactId>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-jasper</artifactId>
     </dependency>
     <dependency>
       <groupId>org.apache.kerby</groupId>
diff --git a/hbase-server/pom.xml b/hbase-server/pom.xml
index 132e1faa6ca6..b81c1492af9e 100644
--- a/hbase-server/pom.xml
+++ b/hbase-server/pom.xml
@@ -181,8 +181,8 @@
       <!-- For JspC used in ant task, then needed at compile /runtime
            because the source code made from the JSP refers to its runtime
         -->
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp</artifactId>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-jasper</artifactId>
     </dependency>
     <!-- Also used by generated sources from our JSP -->
     <dependency>
diff --git a/hbase-shaded/hbase-shaded-mapreduce/pom.xml b/hbase-shaded/hbase-shaded-mapreduce/pom.xml
index 1b590f0d0421..a5dd3c75540e 100644
--- a/hbase-shaded/hbase-shaded-mapreduce/pom.xml
+++ b/hbase-shaded/hbase-shaded-mapreduce/pom.xml
@@ -101,8 +101,8 @@
           <artifactId>jetty-util-ajax</artifactId>
         </exclusion>
         <exclusion>
-          <groupId>org.glassfish</groupId>
-          <artifactId>javax.el</artifactId>
+          <groupId>org.apache.tomcat</groupId>
+          <artifactId>tomcat-jasper</artifactId>
         </exclusion>
         <exclusion>
           <groupId>org.eclipse.jetty</groupId>
diff --git a/hbase-thrift/pom.xml b/hbase-thrift/pom.xml
index 64d8fc933ab7..0cd15bd48529 100644
--- a/hbase-thrift/pom.xml
+++ b/hbase-thrift/pom.xml
@@ -114,15 +114,8 @@
     </dependency>
     <dependency>
       <!--For JspC used in ant task-->
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp</artifactId>
-    </dependency>
-    <!-- Specifically needed for jetty-jsp, included
-         to bypass version scanning that hits a bad repo
-         see HBASE-18831 -->
-    <dependency>
-      <groupId>org.glassfish</groupId>
-      <artifactId>javax.el</artifactId>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-jasper</artifactId>
     </dependency>
     <dependency>
       <groupId>org.apache.kerby</groupId>
diff --git a/pom.xml b/pom.xml
index 9190f7a4d0ca..46de456a4cec 100644
--- a/pom.xml
+++ b/pom.xml
@@ -595,8 +595,7 @@
     <jaxb-api.version>2.3.1</jaxb-api.version>
     <servlet.api.version>3.1.0</servlet.api.version>
     <wx.rs.api.version>2.1.1</wx.rs.api.version>
-    <glassfish.jsp.version>2.3.2</glassfish.jsp.version>
-    <glassfish.el.version>3.0.1-b08</glassfish.el.version>
+    <tomcat.jasper.version>9.0.93</tomcat.jasper.version>
     <jruby.version>9.4.8.0</jruby.version>
     <junit.version>4.13.2</junit.version>
     <hamcrest.version>1.3</hamcrest.version>
@@ -1317,9 +1316,23 @@
       </dependency>
       <dependency>
         <!--This lib has JspC in it. Needed precompiling jsps in hbase-rest, etc.-->
-        <groupId>org.glassfish.web</groupId>
-        <artifactId>javax.servlet.jsp</artifactId>
-        <version>${glassfish.jsp.version}</version>
+        <groupId>org.apache.tomcat</groupId>
+        <artifactId>tomcat-jasper</artifactId>
+        <version>${tomcat.jasper.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.eclipse.jdt</groupId>
+            <artifactId>ecj</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.apache.tomcat</groupId>
+            <artifactId>tomcat-servlet-api</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.apache.tomcat</groupId>
+            <artifactId>tomcat-jsp-api</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <!-- this lib is used by the compiled Jsp from the above JspC -->
@@ -1327,11 +1340,6 @@
         <artifactId>javax.servlet.jsp-api</artifactId>
         <version>2.3.1</version>
       </dependency>
-      <dependency>
-        <groupId>org.glassfish</groupId>
-        <artifactId>javax.el</artifactId>
-        <version>${glassfish.el.version}</version>
-      </dependency>
       <dependency>
         <groupId>javax.xml.bind</groupId>
         <artifactId>jaxb-api</artifactId>