Uh oh!
There was an error while loading. Please reload this page.
HBASE-28070 Replace javax.servlet.jsp dependency with tomcat-jasper - #5607
Conversation
NihalJain
commented
Jan 6, 2024
Built code locally, generated assembly, untarred assembly, started local hbase instance. Tested Master/RS Web UI, works fine. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
| <exclude>junit:junit</exclude> | ||
| <exclude>org.hamcrest:hamcrest-core</exclude> | ||
| <exclude>org.mockito:mockito-core</exclude> | ||
| <!-- Exclude transitive dependencies of tomcat-jasper, not needed at runtime --> |
There was a problem hiding this comment.
We do not need this for our release binaries? For client I think it is OK that we do not need to start a web server, but for hbase we do need to start master/rs webs?
There was a problem hiding this comment.
I tested out master startup in local mode. Was able to start with just tomcat-jasper, tomcat-jasper-el and tomcat-el-api and hence removed others. Also these 3 jars bring in all those classes which are getting removed from classpath due to removal of javax.el and javax.servlet.jsp.
Can keep these for safer side. Please let me know WDYT.
There was a problem hiding this comment.
Then we could just exclude them in the dependencyManagement or dependencies section in our pom file? We need to them in tests?
There was a problem hiding this comment.
Yes @Apache9, these are required at compile time to generate the jsp pages but i was able to load web pages w/o them during runtime. Hence excluding from assembly.
Few others which were not needed at all, I have already excluded in dependencies section for the dependency.
There was a problem hiding this comment.
Hi @Apache9 seems someone is interested in this patch. Could you please have another look at the changes and the above discussion and see if we are good here. Please let me know if otherwise.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
NihalJain
commented
Jan 7, 2024
Update:
Please let me know if anything else needs to be checked. |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
NihalJain
commented
Feb 9, 2024
Ping @Apache9, any thoughts on this change/approach? Failures are not related. |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Uh oh!
There was an error while loading. Please reload this page.
NihalJain
commented
Aug 14, 2024
All works as expected with the latest tomcat-tasper and post rebasing. Please review! |
This comment has been minimized.
This comment has been minimized.
Apache-HBase
commented
Aug 14, 2024
🎊 +1 overall
This message was automatically generated. |
Apache-HBase
commented
Aug 15, 2024
🎊 +1 overall
This message was automatically generated. |
szucsvillo
left a comment
There was a problem hiding this comment.
It looks good to me, but I'm not an hbase committer, I'd be happy if someone else would take a look.
NihalJain
commented
Aug 17, 2024
Gentle ping @Apache9, does this look fine to you? |
NihalJain
commented
Aug 21, 2024
Hi @ndimiduk would you have bandwidth to review this one? |
NihalJain
commented
Aug 21, 2024
Updated PR description for reviewers to have more context on this PR, for ease of review. |
ndimiduk
commented
Aug 21, 2024
@NihalJain not at the moment -- maybe someone else will be faster to respond. |
NihalJain
commented
Aug 30, 2024
Thank you @ndimiduk for your response. |
ndimiduk
left a comment
There was a problem hiding this comment.
Heya @NihalJain thank you for the effort here. I appreciate you reporting your manual testing results here. Can you provide one more bit of information for reviewers -- I'd like to see a diff of the file listing of the hbase assembly with and without this patch (vs. both hadoop versions if you plan to backport to branch-2). That will help us to spot-check for other side-effects of this change. Thank you!
Hey Nick thanks for taking your time to look onto this. Please find diff for master on b161ad5 with hadoop-3 built on JDK17 vs patch rebased to b161ad5: Diff: Detailed Diff: Let me create a PR for branch-2 and repeat the manual tests along with diff on both versions of hadoop. |
This comment has been minimized.
This comment has been minimized.
NihalJain
commented
Sep 8, 2024
Updated details and PR at #6218 |
…pache#5607) Signed-off-by: Istvan Toth <stoty@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit b6394b1)
…pache#6218) (apache#5607) - Also handle changes required for hadoop-2 assembly Signed-off-by: Istvan Toth <stoty@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 2537690)
…pache#6218) (apache#5607) - Also handle changes required for hadoop-2 assembly Signed-off-by: Istvan Toth <stoty@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit b6394b1) (cherry picked from commit 2537690)
…pache#6218) (apache#5607) - Also handle changes required for hadoop-2 assembly Signed-off-by: Istvan Toth <stoty@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit b6394b1) (cherry picked from commit 2537690)
The main driving force behind this PR is the need to remove the org.glassfish:javax.el:jar:3.0.1-b08 dependency from our project, which was added as a direct dependency due to HBASE-18831. Not only has org.glassfish:javax.el reached EOL, but it also has a known vulnerability (CVE-2020-15250). Additionally, it is required by the javax.servlet.jsp dependency, which we are using currently.
To eliminate the org.glassfish:javax.el dependency, this change proposes to replace the javax.servlet.jsp dependency with tomcat-jasper. This change also allows us to use JspC in an Ant task.
tomcat-jasper includes several transitive dependencies. However, we discovered that not all of these are necessary for our specific use case. The dependencies ecj (Eclipse Compiler for Java), tomcat-servlet-api, and tomcat-jsp-api have been excluded as they were not needed at all to build and run code.
The dependencies tomcat-juli, tomcat-api, tomcat-util-scan, and tomcat-util are retained as they are needed during the compilation phase but excluded during assembly to keep our deployment artifacts lean.
These changes have been thoroughly tested to ensure the application behaves as expected. However, additional testing is encouraged to validate these changes in different environments. With this PR, we are able to completely remove org.glassfish:javax.el:jar:3.0.1-b08 from our dependency tree.