HBASE-28070 Replace javax.servlet.jsp dependency with tomcat-jasper (#…

…6218) (#5607) - Also handle changes required for hadoop-2 assembly Signed-off-by: Istvan Toth <stoty@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit b6394b1) (cherry picked from commit 2537690)
apache · Nov 4, 2024 · 4c9356c · 4c9356c
1 parent e1a610b
commit 4c9356c
Show file tree

Hide file tree

Showing 9 changed files with 41 additions and 71 deletions.
diff --git a/hbase-assembly/src/main/assembly/client.xml b/hbase-assembly/src/main/assembly/client.xml
@@ -66,6 +66,11 @@
               <exclude>io.opentelemetry.javaagent:*</exclude>
               <exclude>org.hamcrest:hamcrest-core</exclude>
               <exclude>org.mockito:mockito-core</exclude>
+              <!-- Exclude transitive dependencies of tomcat-jasper, not needed at runtime -->
+              <exclude>org.apache.tomcat:tomcat-juli</exclude>
+              <exclude>org.apache.tomcat:tomcat-api</exclude>
+              <exclude>org.apache.tomcat:tomcat-util-scan</exclude>
+              <exclude>org.apache.tomcat:tomcat-util</exclude>
             </excludes>
           </dependencySet>
         </dependencySets>

diff --git a/hbase-assembly/src/main/assembly/hadoop-three-compat.xml b/hbase-assembly/src/main/assembly/hadoop-three-compat.xml
@@ -113,6 +113,11 @@
               <exclude>junit:junit</exclude>
               <exclude>org.hamcrest:hamcrest-core</exclude>
               <exclude>org.mockito:mockito-core</exclude>
+              <!-- Exclude transitive dependencies of tomcat-jasper, not needed at runtime -->
+              <exclude>org.apache.tomcat:tomcat-juli</exclude>
+              <exclude>org.apache.tomcat:tomcat-api</exclude>
+              <exclude>org.apache.tomcat:tomcat-util-scan</exclude>
+              <exclude>org.apache.tomcat:tomcat-util</exclude>
             </excludes>
           </dependencySet>
         </dependencySets>

diff --git a/hbase-assembly/src/main/assembly/hadoop-two-compat.xml b/hbase-assembly/src/main/assembly/hadoop-two-compat.xml
@@ -113,6 +113,11 @@
               <exclude>org.slf4j:*</exclude>
               <exclude>org.apache.logging.log4j:*</exclude>
               <exclude>io.opentelemetry.javaagent:*</exclude>
+              <!-- Exclude transitive dependencies of tomcat-jasper, not needed at runtime -->
+              <exclude>org.apache.tomcat:tomcat-juli</exclude>
+              <exclude>org.apache.tomcat:tomcat-api</exclude>
+              <exclude>org.apache.tomcat:tomcat-util-scan</exclude>
+              <exclude>org.apache.tomcat:tomcat-util</exclude>
             </excludes>
           </dependencySet>
         </dependencySets>

diff --git a/hbase-resource-bundle/src/main/resources/supplemental-models.xml b/hbase-resource-bundle/src/main/resources/supplemental-models.xml
@@ -348,19 +348,6 @@ under the License.
       </licenses>
     </project>
   </supplement>
-  <supplement>
-    <project>
-      <groupId>org.glassfish</groupId>
-      <artifactId>javax.el</artifactId>
-      <licenses>
-        <license>
-          <name>CDDL 1.1</name>
-          <url>https://glassfish.java.net/public/CDDL+GPL_1_1.html</url>
-          <distribution>repo</distribution>
-        </license>
-      </licenses>
-    </project>
-  </supplement>
   <supplement>
     <project>
       <groupId>org.glassfish.hk2</groupId>
@@ -530,32 +517,6 @@ under the License.
       </licenses>
     </project>
   </supplement>
-  <supplement>
-    <project>
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp</artifactId>
-      <licenses>
-        <license>
-          <name>CDDL 1.1</name>
-          <url>https://glassfish.java.net/public/CDDL+GPL_1_1.html</url>
-          <distribution>repo</distribution>
-        </license>
-      </licenses>
-    </project>
-  </supplement>
-  <supplement>
-    <project>
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp.jstl</artifactId>
-      <licenses>
-        <license>
-          <name>CDDL 1.1</name>
-          <url>https://glassfish.java.net/public/CDDL+GPL_1_1.html</url>
-          <distribution>repo</distribution>
-        </license>
-      </licenses>
-    </project>
-  </supplement>
   <supplement>
     <project>
       <groupId>javax.validation</groupId>

diff --git a/hbase-rest/pom.xml b/hbase-rest/pom.xml
@@ -191,15 +191,8 @@
     </dependency>
     <dependency>
       <!--For JspC used in ant task-->
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp</artifactId>
-    </dependency>
-    <!-- Specifically needed for jetty-jsp, included
-         to bypass version scanning that hits a bad repo
-         see HBASE-18831 -->
-    <dependency>
-      <groupId>org.glassfish</groupId>
-      <artifactId>javax.el</artifactId>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-jasper</artifactId>
     </dependency>
     <dependency>
       <groupId>org.apache.kerby</groupId>

diff --git a/hbase-server/pom.xml b/hbase-server/pom.xml
@@ -181,8 +181,8 @@
       <!-- For JspC used in ant task, then needed at compile /runtime
            because the source code made from the JSP refers to its runtime
         -->
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp</artifactId>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-jasper</artifactId>
     </dependency>
     <!-- Also used by generated sources from our JSP -->
     <dependency>

diff --git a/hbase-shaded/hbase-shaded-mapreduce/pom.xml b/hbase-shaded/hbase-shaded-mapreduce/pom.xml
@@ -101,8 +101,8 @@
           <artifactId>jetty-util-ajax</artifactId>
         </exclusion>
         <exclusion>
-          <groupId>org.glassfish</groupId>
-          <artifactId>javax.el</artifactId>
+          <groupId>org.apache.tomcat</groupId>
+          <artifactId>tomcat-jasper</artifactId>
         </exclusion>
         <exclusion>
           <groupId>org.eclipse.jetty</groupId>

diff --git a/hbase-thrift/pom.xml b/hbase-thrift/pom.xml
@@ -114,15 +114,8 @@
     </dependency>
     <dependency>
       <!--For JspC used in ant task-->
-      <groupId>org.glassfish.web</groupId>
-      <artifactId>javax.servlet.jsp</artifactId>
-    </dependency>
-    <!-- Specifically needed for jetty-jsp, included
-         to bypass version scanning that hits a bad repo
-         see HBASE-18831 -->
-    <dependency>
-      <groupId>org.glassfish</groupId>
-      <artifactId>javax.el</artifactId>
+      <groupId>org.apache.tomcat</groupId>
+      <artifactId>tomcat-jasper</artifactId>
     </dependency>
     <dependency>
       <groupId>org.apache.kerby</groupId>

diff --git a/pom.xml b/pom.xml
@@ -595,8 +595,7 @@
     <jaxb-api.version>2.3.1</jaxb-api.version>
     <servlet.api.version>3.1.0</servlet.api.version>
     <wx.rs.api.version>2.1.1</wx.rs.api.version>
-    <glassfish.jsp.version>2.3.2</glassfish.jsp.version>
-    <glassfish.el.version>3.0.1-b08</glassfish.el.version>
+    <tomcat.jasper.version>9.0.93</tomcat.jasper.version>
     <jruby.version>9.3.13.0</jruby.version>
     <junit.version>4.13.2</junit.version>
     <hamcrest.version>1.3</hamcrest.version>
@@ -1322,21 +1321,30 @@
       </dependency>
       <dependency>
         <!--This lib has JspC in it. Needed precompiling jsps in hbase-rest, etc.-->
-        <groupId>org.glassfish.web</groupId>
-        <artifactId>javax.servlet.jsp</artifactId>
-        <version>${glassfish.jsp.version}</version>
+        <groupId>org.apache.tomcat</groupId>
+        <artifactId>tomcat-jasper</artifactId>
+        <version>${tomcat.jasper.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.eclipse.jdt</groupId>
+            <artifactId>ecj</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.apache.tomcat</groupId>
+            <artifactId>tomcat-servlet-api</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.apache.tomcat</groupId>
+            <artifactId>tomcat-jsp-api</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <!-- this lib is used by the compiled Jsp from the above JspC -->
         <groupId>javax.servlet.jsp</groupId>
         <artifactId>javax.servlet.jsp-api</artifactId>
         <version>2.3.1</version>
       </dependency>
-      <dependency>
-        <groupId>org.glassfish</groupId>
-        <artifactId>javax.el</artifactId>
-        <version>${glassfish.el.version}</version>
-      </dependency>
       <dependency>
         <groupId>javax.xml.bind</groupId>
         <artifactId>jaxb-api</artifactId>