From 6cdd0464fec833e678dff03e62baa64f76b41aa2 Mon Sep 17 00:00:00 2001
From: Nihal Jain <nihaljain@apache.org>
Date: Mon, 21 Oct 2024 21:26:41 +0530
Subject: [PATCH] HBASE-28921 Skip bundling hbase-webapps folder in jars
 (#6368)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We are bundling all webapp resources in hbase-server, hbase-thrift, hbase-rest and transitively to hbase-shaded-mapreduce jar. This can be an issue, say if any of the Js projects used by hbase are vulnerable, security scan tools like sonatype start flagging the jars too as vulnerable since they contain vulnerable code.

With this JIRA, we skip bundling static webapp resources in our jars.

Signed-off-by: Istvan Toth <stoty@apache.org>
Reviewed-by: Dávid Paksy <paksyd@cloudera.com>

(cherry picked from commit 836630422df2776287a860eff9d7104c3eca0582)
---
 hbase-rest/pom.xml   | 9 +++++++++
 hbase-server/pom.xml | 1 +
 hbase-thrift/pom.xml | 9 +++++++++
 3 files changed, 19 insertions(+)

diff --git a/hbase-rest/pom.xml b/hbase-rest/pom.xml
index 64ce0eb7746c..c57a896c8c0d 100644
--- a/hbase-rest/pom.xml
+++ b/hbase-rest/pom.xml
@@ -290,6 +290,15 @@
           <skipAssembly>true</skipAssembly>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-jar-plugin</artifactId>
+        <configuration>
+          <excludes>
+            <exclude>**/hbase-webapps/**</exclude>
+          </excludes>
+        </configuration>
+      </plugin>
       <!-- General ant tasks, bound to different build phases -->
       <plugin>
         <artifactId>maven-antrun-plugin</artifactId>
diff --git a/hbase-server/pom.xml b/hbase-server/pom.xml
index b81c1492af9e..327579d5b00e 100644
--- a/hbase-server/pom.xml
+++ b/hbase-server/pom.xml
@@ -465,6 +465,7 @@
             <exclude>log4j.properties</exclude>
             <exclude>mapred-queues.xml</exclude>
             <exclude>mapred-site.xml</exclude>
+            <exclude>**/hbase-webapps/**</exclude>
           </excludes>
         </configuration>
       </plugin>
diff --git a/hbase-thrift/pom.xml b/hbase-thrift/pom.xml
index 0cd15bd48529..049ed345f939 100644
--- a/hbase-thrift/pom.xml
+++ b/hbase-thrift/pom.xml
@@ -203,6 +203,15 @@
           <skipAssembly>true</skipAssembly>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-jar-plugin</artifactId>
+        <configuration>
+          <excludes>
+            <exclude>**/hbase-webapps/**</exclude>
+          </excludes>
+        </configuration>
+      </plugin>
       <!-- General ant tasks, bound to different build phases -->
       <plugin>
         <artifactId>maven-antrun-plugin</artifactId>