From 0afaa34b313172526ccbb14d405f025743cf7e99 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Nov 2025 13:22:55 +0000
Subject: [PATCH 01/15] Initial plan


From b94585bc69d70b15c46241365f0289703fb3e1aa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Nov 2025 13:31:34 +0000
Subject: [PATCH 02/15] Convert ProxyServlet to use JDK 11 HttpClient

- Removed Apache HttpClient dependencies from pom.xml
- Rewrote ProxyServlet to use java.net.http.HttpClient
- Updated URITemplateProxyServlet to remove Apache HTTP dependencies
- Updated OSGI manifest imports
- Code compiles successfully

Co-authored-by: dsmiley <377295+dsmiley@users.noreply.github.com>
---
 pom.xml                                       |  32 +-
 .../mitre/dsmiley/httpproxy/ProxyServlet.java | 333 ++++++++----------
 .../httpproxy/URITemplateProxyServlet.java    |  49 ++-
 3 files changed, 181 insertions(+), 233 deletions(-)

diff --git a/pom.xml b/pom.xml
index 73b6685..8ff05f8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -40,11 +40,6 @@
 
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-
-    <!-- works with v4.3 and forward; see .github/workflows/maven.yml -->
-    <httpclient.version>[4.5.14,5.0)</httpclient.version>
-    <!-- the last version to provide LocalTestServer.java -->
-    <httpclient.test.version>4.3.6</httpclient.test.version>
   </properties>
 
   <!-- To check for new plugins and dependencies:
@@ -61,12 +56,6 @@
       <scope>provided</scope>
     </dependency>
 
-    <dependency>
-      <groupId>org.apache.httpcomponents</groupId>
-      <artifactId>httpclient</artifactId>
-      <version>${httpclient.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
@@ -74,14 +63,6 @@
       <scope>test</scope>
     </dependency>
 
-    <dependency>
-      <groupId>org.apache.httpcomponents</groupId>
-      <artifactId>httpclient</artifactId>
-      <version>${httpclient.test.version}</version>
-      <classifier>tests</classifier>
-      <scope>test</scope>
-    </dependency>
-
     <dependency>
       <groupId>com.github.hazendaz.httpunit</groupId>
       <artifactId>httpunit</artifactId>
@@ -159,17 +140,10 @@
               <Bundle-Name>${project.artifactId}</Bundle-Name>
               <Bundle-SymbolicName>org.mitre.dsmiley.http-proxy-servlet</Bundle-SymbolicName>
               <Export-Package>org.mitre.dsmiley.httpproxy;version="0"</Export-Package>
-              <Import-Package>org.apache.http;version="0",
- org.apache.http.client;version="0",
- org.apache.http.entity;version="0",
- org.apache.http.impl.client;version="0",
- org.apache.http.message;version="0",
- org.apache.http.util; version="0",
- org.apache.http.client.utils;version="0",
- org.apache.http.client.methods;version="0",
- jakarta.servlet;version="0",
+              <Import-Package>jakarta.servlet;version="0",
  jakarta.servlet.http;version="0",
- javax.net.ssl;version="0", org.apache.http.client.config;version="0"</Import-Package>
+ javax.net.ssl;version="0",
+ java.net.http;version="0"</Import-Package>
             </manifestEntries>
           </archive>
         </configuration>
diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index 41b2983..7c0f360 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -16,46 +16,30 @@
 
 package org.mitre.dsmiley.httpproxy;
 
-import org.apache.http.Header;
-import org.apache.http.HttpEntity;
-import org.apache.http.HttpEntityEnclosingRequest;
-import org.apache.http.HttpHeaders;
-import org.apache.http.HttpHost;
-import org.apache.http.HttpRequest;
-import org.apache.http.HttpResponse;
-import org.apache.http.client.HttpClient;
-import org.apache.http.client.config.CookieSpecs;
-import org.apache.http.client.config.RequestConfig;
-import org.apache.http.client.methods.AbortableHttpRequest;
-import org.apache.http.client.utils.URIUtils;
-import org.apache.http.config.SocketConfig;
-import org.apache.http.entity.InputStreamEntity;
-import org.apache.http.impl.client.HttpClientBuilder;
-import org.apache.http.message.BasicHeader;
-import org.apache.http.message.BasicHttpEntityEnclosingRequest;
-import org.apache.http.message.BasicHttpRequest;
-import org.apache.http.message.HeaderGroup;
-import org.apache.http.util.EntityUtils;
-
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServlet;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
-import java.io.Closeable;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.net.HttpCookie;
 import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.time.Duration;
 import java.util.BitSet;
 import java.util.Enumeration;
 import java.util.Formatter;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
 
 /**
  * An HTTP reverse proxy/gateway servlet. It is designed to be extended for customization
- * if desired. Most of the work is handled by
- * <a href="http://hc.apache.org/httpcomponents-client-ga/">Apache HttpClient</a>.
+ * if desired. Most of the work is handled by the JDK 11 HttpClient.
  * <p>
  *   There are alternatives to a servlet based proxy such as Apache mod_proxy if that is available to you. However
  *   this servlet is easily customizable by Java, secure-able by your web application's security (e.g. spring-security),
@@ -138,7 +122,7 @@ public class ProxyServlet extends HttpServlet {
   /** From the configured parameter "targetUri". */
   protected String targetUri;
   protected URI targetUriObj;//new URI(targetUri)
-  protected HttpHost targetHost;//URIUtils.extractHost(targetUriObj);
+  protected String targetHost;//host:port from targetUriObj
 
   private HttpClient proxyClient;
 
@@ -152,8 +136,8 @@ protected String getTargetUri(HttpServletRequest servletRequest) {
     return (String) servletRequest.getAttribute(ATTR_TARGET_URI);
   }
 
-  protected HttpHost getTargetHost(HttpServletRequest servletRequest) {
-    return (HttpHost) servletRequest.getAttribute(ATTR_TARGET_HOST);
+  protected String getTargetHost(HttpServletRequest servletRequest) {
+    return (String) servletRequest.getAttribute(ATTR_TARGET_HOST);
   }
 
   /**
@@ -232,30 +216,25 @@ public void init() throws ServletException {
   }
 
   /**
-   * Sub-classes can override specific behaviour of {@link org.apache.http.client.config.RequestConfig}.
-   */
-  protected RequestConfig buildRequestConfig() {
-    return RequestConfig.custom()
-            .setRedirectsEnabled(doHandleRedirects)
-            .setCookieSpec(CookieSpecs.IGNORE_COOKIES) // we handle them in the servlet instead
-            .setConnectTimeout(connectTimeout)
-            .setSocketTimeout(readTimeout)
-            .setConnectionRequestTimeout(connectionRequestTimeout)
-            .build();
-  }
-
-  /**
-   * Sub-classes can override specific behaviour of {@link org.apache.http.config.SocketConfig}.
+   * Sub-classes can override specific behaviour of the HttpClient builder.
    */
-  protected SocketConfig buildSocketConfig() {
-
-    if (readTimeout < 1) {
-      return null;
+  protected HttpClient.Builder buildClientBuilder() {
+    HttpClient.Builder builder = HttpClient.newBuilder();
+    
+    if (doHandleRedirects) {
+      builder.followRedirects(HttpClient.Redirect.NORMAL);
+    } else {
+      builder.followRedirects(HttpClient.Redirect.NEVER);
     }
-
-    return SocketConfig.custom()
-            .setSoTimeout(readTimeout)
-            .build();
+    
+    if (connectTimeout > 0) {
+      builder.connectTimeout(Duration.ofMillis(connectTimeout));
+    }
+    
+    // Note: JDK HttpClient doesn't have direct equivalents for all Apache HttpClient settings
+    // like connection request timeout or max connections per route
+    
+    return builder;
   }
 
   protected void initTarget() throws ServletException {
@@ -268,27 +247,29 @@ protected void initTarget() throws ServletException {
     } catch (Exception e) {
       throw new ServletException("Trying to process targetUri init parameter: "+e,e);
     }
-    targetHost = URIUtils.extractHost(targetUriObj);
+    targetHost = extractHost(targetUriObj);
+  }
+
+  /**
+   * Extract host:port from URI
+   */
+  private String extractHost(URI uri) {
+    String host = uri.getHost();
+    int port = uri.getPort();
+    if (port == -1) {
+      return host;
+    }
+    return host + ":" + port;
   }
 
   /**
    * Called from {@link #init(jakarta.servlet.ServletConfig)}.
-   * HttpClient offers many opportunities for customization.
+   * HttpClient offers opportunities for customization.
    * In any case, it should be thread-safe.
    */
   protected HttpClient createHttpClient() {
-    HttpClientBuilder clientBuilder = getHttpClientBuilder()
-                                        .setDefaultRequestConfig(buildRequestConfig())
-                                        .setDefaultSocketConfig(buildSocketConfig());
-
-    clientBuilder.setMaxConnTotal(maxConnections);
-    clientBuilder.setMaxConnPerRoute(maxConnections);
-    if(! doHandleCompression) {
-      clientBuilder.disableContentCompression();
-    }
-
-    if (useSystemProperties)
-      clientBuilder = clientBuilder.useSystemProperties();
+    HttpClient.Builder clientBuilder = buildClientBuilder();
+    
     return buildHttpClient(clientBuilder);
   }
 
@@ -300,18 +281,18 @@ protected HttpClient createHttpClient() {
    * @param clientBuilder pre-configured client builder
    * @return HttpClient
    */
-  protected HttpClient buildHttpClient(HttpClientBuilder clientBuilder) {
+  protected HttpClient buildHttpClient(HttpClient.Builder clientBuilder) {
     return clientBuilder.build();
   }
 
   /**
-   * Creates a {@code HttpClientBuilder}. Meant as preprocessor to possibly
+   * Creates a {@code HttpClient.Builder}. Meant as preprocessor to possibly
    * adapt the client builder prior to any configuration got applied.
    *
    * @return HttpClient builder
    */
-  protected HttpClientBuilder getHttpClientBuilder() {
-    return HttpClientBuilder.create();
+  protected HttpClient.Builder getHttpClientBuilder() {
+    return HttpClient.newBuilder();
   }
 
   /**
@@ -324,18 +305,7 @@ protected HttpClient getProxyClient() {
 
   @Override
   public void destroy() {
-    //Usually, clients implement Closeable:
-    if (proxyClient instanceof Closeable) {
-      try {
-        ((Closeable) proxyClient).close();
-      } catch (IOException e) {
-        log("While destroying servlet, shutting down HttpClient: "+e, e);
-      }
-    } else {
-      //Older releases require we do this:
-      if (proxyClient != null)
-        proxyClient.getConnectionManager().shutdown();
-    }
+    // JDK HttpClient doesn't need explicit cleanup
     super.destroy();
   }
 
@@ -351,42 +321,57 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     }
 
     // Make the Request
-    //note: we won't transfer the protocol version because I'm not sure it would truly be compatible
     String method = servletRequest.getMethod();
     String proxyRequestUri = rewriteUrlFromRequest(servletRequest);
-    HttpRequest proxyRequest;
-    //spec: RFC 2616, sec 4.3: either of these two headers signal that there is a message body.
-    if (servletRequest.getHeader(HttpHeaders.CONTENT_LENGTH) != null ||
-        servletRequest.getHeader(HttpHeaders.TRANSFER_ENCODING) != null) {
-      proxyRequest = newProxyRequestWithEntity(method, proxyRequestUri, servletRequest);
+    
+    HttpRequest.Builder proxyRequestBuilder = HttpRequest.newBuilder()
+        .uri(URI.create(proxyRequestUri));
+    
+    // Set method and body
+    HttpRequest.BodyPublisher bodyPublisher;
+    if (servletRequest.getHeader("Content-Length") != null ||
+        servletRequest.getHeader("Transfer-Encoding") != null) {
+      long contentLength = getContentLength(servletRequest);
+      bodyPublisher = HttpRequest.BodyPublishers.ofInputStream(() -> {
+        try {
+          return servletRequest.getInputStream();
+        } catch (IOException e) {
+          throw new RuntimeException(e);
+        }
+      });
     } else {
-      proxyRequest = new BasicHttpRequest(method, proxyRequestUri);
-    }
-
-    copyRequestHeaders(servletRequest, proxyRequest);
-
-    setXForwardedForHeader(servletRequest, proxyRequest);
-
-    HttpResponse proxyResponse = null;
+      bodyPublisher = HttpRequest.BodyPublishers.noBody();
+    }
+    
+    proxyRequestBuilder.method(method, bodyPublisher);
+    
+    // Set timeout if configured
+    if (readTimeout > 0) {
+      proxyRequestBuilder.timeout(Duration.ofMillis(readTimeout));
+    }
+    
+    // Copy request headers
+    copyRequestHeaders(servletRequest, proxyRequestBuilder);
+    setXForwardedForHeader(servletRequest, proxyRequestBuilder);
+    
+    HttpRequest proxyRequest = proxyRequestBuilder.build();
+    
+    HttpResponse<InputStream> proxyResponse = null;
     try {
       // Execute the request
       proxyResponse = doExecute(servletRequest, servletResponse, proxyRequest);
 
       // Process the response:
-
-      int statusCode = proxyResponse.getStatusLine().getStatusCode();
+      int statusCode = proxyResponse.statusCode();
       servletResponse.setStatus(statusCode);
 
-      // Copying response headers to make sure SESSIONID or other Cookie which comes from the remote
-      // server will be saved in client when the proxied url was redirected to another one.
-      // See issue [#51](https://github.com/mitre/HTTP-Proxy-Servlet/issues/51)
+      // Copy response headers
       copyResponseHeaders(proxyResponse, servletRequest, servletResponse);
 
       if (statusCode == HttpServletResponse.SC_NOT_MODIFIED) {
-        // 304 needs special handling.  See:
-        // http://www.ics.uci.edu/pub/ietf/http/rfc1945.html#Code304
+        // 304 needs special handling.
         // Don't send body entity/content!
-        servletResponse.setIntHeader(HttpHeaders.CONTENT_LENGTH, 0);
+        servletResponse.setIntHeader("Content-Length", 0);
       } else {
         // Send the content to the client
         copyResponseEntity(proxyResponse, servletResponse, proxyRequest, servletRequest);
@@ -395,26 +380,25 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     } catch (Exception e) {
       handleRequestException(proxyRequest, proxyResponse, e);
     } finally {
-      // make sure the entire entity was consumed, so the connection is released
-      if (proxyResponse != null)
-        EntityUtils.consumeQuietly(proxyResponse.getEntity());
-      //Note: Don't need to close servlet outputStream:
-      // http://stackoverflow.com/questions/1159168/should-one-call-close-on-httpservletresponse-getoutputstream-getwriter
+      // Close response body if present
+      if (proxyResponse != null && proxyResponse.body() != null) {
+        try {
+          proxyResponse.body().close();
+        } catch (IOException e) {
+          // Ignore
+        }
+      }
     }
   }
 
-  protected void handleRequestException(HttpRequest proxyRequest, HttpResponse proxyResponse, Exception e) throws ServletException, IOException {
-    //abort request, according to best practice with HttpClient
-    if (proxyRequest instanceof AbortableHttpRequest) {
-      AbortableHttpRequest abortableHttpRequest = (AbortableHttpRequest) proxyRequest;
-      abortableHttpRequest.abort();
-    }
-    // If the response is a chunked response, it is read to completion when
-    // #close is called. If the sending site does not timeout or keeps sending,
-    // the connection will be kept open indefinitely. Closing the respone
-    // object terminates the stream.
-    if (proxyResponse instanceof Closeable) {
-      ((Closeable) proxyResponse).close();
+  protected void handleRequestException(HttpRequest proxyRequest, HttpResponse<InputStream> proxyResponse, Exception e) throws ServletException, IOException {
+    // Close the response if present
+    if (proxyResponse != null && proxyResponse.body() != null) {
+      try {
+        proxyResponse.body().close();
+      } catch (IOException ex) {
+        // Ignore
+      }
     }
     if (e instanceof RuntimeException)
       throw (RuntimeException)e;
@@ -426,25 +410,18 @@ protected void handleRequestException(HttpRequest proxyRequest, HttpResponse pro
     throw new RuntimeException(e);
   }
 
-  protected HttpResponse doExecute(HttpServletRequest servletRequest, HttpServletResponse servletResponse,
+  protected HttpResponse<InputStream> doExecute(HttpServletRequest servletRequest, HttpServletResponse servletResponse,
                                    HttpRequest proxyRequest) throws IOException {
     if (doLog) {
       log("proxy " + servletRequest.getMethod() + " uri: " + servletRequest.getRequestURI() + " -- " +
-              proxyRequest.getRequestLine().getUri());
+              proxyRequest.uri());
+    }
+    try {
+      return proxyClient.send(proxyRequest, HttpResponse.BodyHandlers.ofInputStream());
+    } catch (InterruptedException e) {
+      Thread.currentThread().interrupt();
+      throw new IOException("Request interrupted", e);
     }
-    return proxyClient.execute(getTargetHost(servletRequest), proxyRequest);
-  }
-
-  protected HttpRequest newProxyRequestWithEntity(String method, String proxyRequestUri,
-                                                HttpServletRequest servletRequest)
-          throws IOException {
-    HttpEntityEnclosingRequest eProxyRequest =
-            new BasicHttpEntityEnclosingRequest(method, proxyRequestUri);
-    // Add the input entity (streamed)
-    //  note: we don't bother ensuring we close the servletInputStream since the container handles it
-    eProxyRequest.setEntity(
-            new InputStreamEntity(servletRequest.getInputStream(), getContentLength(servletRequest)));
-    return eProxyRequest;
   }
 
   // Get the header value as a long in order to more correctly proxy very large requests
@@ -456,27 +433,17 @@ private long getContentLength(HttpServletRequest request) {
     return -1L;
   }
 
-  protected void closeQuietly(Closeable closeable) {
-    try {
-      closeable.close();
-    } catch (IOException e) {
-      log(e.getMessage(), e);
-    }
-  }
-
   /** These are the "hop-by-hop" headers that should not be copied.
    * http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
-   * I use an HttpClient HeaderGroup class instead of Set&lt;String&gt; because this
-   * approach does case insensitive lookup faster.
    */
-  protected static final HeaderGroup hopByHopHeaders;
+  protected static final Set<String> hopByHopHeaders;
   static {
-    hopByHopHeaders = new HeaderGroup();
+    hopByHopHeaders = new HashSet<>();
     String[] headers = new String[] {
         "Connection", "Keep-Alive", "Proxy-Authenticate", "Proxy-Authorization",
         "TE", "Trailers", "Transfer-Encoding", "Upgrade" };
     for (String header : headers) {
-      hopByHopHeaders.addHeader(new BasicHeader(header, null));
+      hopByHopHeaders.add(header.toLowerCase());
     }
   }
 
@@ -484,7 +451,7 @@ protected void closeQuietly(Closeable closeable) {
    * Copy request headers from the servlet client to the proxy request.
    * This is easily overridden to add your own.
    */
-  protected void copyRequestHeaders(HttpServletRequest servletRequest, HttpRequest proxyRequest) {
+  protected void copyRequestHeaders(HttpServletRequest servletRequest, HttpRequest.Builder proxyRequest) {
     // Get an Enumeration of all of the header names sent by the client
     @SuppressWarnings("unchecked")
     Enumeration<String> enumerationOfHeaderNames = servletRequest.getHeaderNames();
@@ -498,16 +465,16 @@ protected void copyRequestHeaders(HttpServletRequest servletRequest, HttpRequest
    * Copy a request header from the servlet client to the proxy request.
    * This is easily overridden to filter out certain headers if desired.
    */
-  protected void copyRequestHeader(HttpServletRequest servletRequest, HttpRequest proxyRequest,
+  protected void copyRequestHeader(HttpServletRequest servletRequest, HttpRequest.Builder proxyRequest,
                                    String headerName) {
     //Instead the content-length is effectively set via InputStreamEntity
-    if (headerName.equalsIgnoreCase(HttpHeaders.CONTENT_LENGTH))
+    if (headerName.equalsIgnoreCase("Content-Length"))
       return;
-    if (hopByHopHeaders.containsHeader(headerName))
+    if (hopByHopHeaders.contains(headerName.toLowerCase()))
       return;
-    // If compression is handled in the servlet, apache http client needs to
+    // If compression is handled in the servlet, JDK http client needs to
     // control the Accept-Encoding header, not the client
-    if (doHandleCompression && headerName.equalsIgnoreCase(HttpHeaders.ACCEPT_ENCODING))
+    if (doHandleCompression && headerName.equalsIgnoreCase("Accept-Encoding"))
       return;
 
     @SuppressWarnings("unchecked")
@@ -517,20 +484,17 @@ protected void copyRequestHeader(HttpServletRequest servletRequest, HttpRequest
       // In case the proxy host is running multiple virtual servers,
       // rewrite the Host header to ensure that we get content from
       // the correct virtual server
-      if (!doPreserveHost && headerName.equalsIgnoreCase(HttpHeaders.HOST)) {
-        HttpHost host = getTargetHost(servletRequest);
-        headerValue = host.getHostName();
-        if (host.getPort() != -1)
-          headerValue += ":"+host.getPort();
-      } else if (!doPreserveCookies && headerName.equalsIgnoreCase(org.apache.http.cookie.SM.COOKIE)) {
+      if (!doPreserveHost && headerName.equalsIgnoreCase("Host")) {
+        headerValue = getTargetHost(servletRequest);
+      } else if (!doPreserveCookies && headerName.equalsIgnoreCase("Cookie")) {
         headerValue = getRealCookie(headerValue);
       }
-      proxyRequest.addHeader(headerName, headerValue);
+      proxyRequest.header(headerName, headerValue);
     }
   }
 
   private void setXForwardedForHeader(HttpServletRequest servletRequest,
-                                      HttpRequest proxyRequest) {
+                                      HttpRequest.Builder proxyRequest) {
     if (doForwardIP) {
       String forHeaderName = "X-Forwarded-For";
       String forHeader = servletRequest.getRemoteAddr();
@@ -547,10 +511,12 @@ private void setXForwardedForHeader(HttpServletRequest servletRequest,
   }
 
   /** Copy proxied response headers back to the servlet client. */
-  protected void copyResponseHeaders(HttpResponse proxyResponse, HttpServletRequest servletRequest,
+  protected void copyResponseHeaders(HttpResponse<InputStream> proxyResponse, HttpServletRequest servletRequest,
                                      HttpServletResponse servletResponse) {
-    for (Header header : proxyResponse.getAllHeaders()) {
-      copyResponseHeader(servletRequest, servletResponse, header);
+    for (String headerName : proxyResponse.headers().map().keySet()) {
+      for (String headerValue : proxyResponse.headers().allValues(headerName)) {
+        copyResponseHeader(servletRequest, servletResponse, headerName, headerValue);
+      }
     }
   }
 
@@ -558,15 +524,13 @@ protected void copyResponseHeaders(HttpResponse proxyResponse, HttpServletReques
    * This is easily overwritten to filter out certain headers if desired.
    */
   protected void copyResponseHeader(HttpServletRequest servletRequest,
-                                  HttpServletResponse servletResponse, Header header) {
-    String headerName = header.getName();
-    if (hopByHopHeaders.containsHeader(headerName))
+                                  HttpServletResponse servletResponse, String headerName, String headerValue) {
+    if (hopByHopHeaders.contains(headerName.toLowerCase()))
       return;
-    String headerValue = header.getValue();
-    if (headerName.equalsIgnoreCase(org.apache.http.cookie.SM.SET_COOKIE) ||
-            headerName.equalsIgnoreCase(org.apache.http.cookie.SM.SET_COOKIE2)) {
+    if (headerName.equalsIgnoreCase("Set-Cookie") ||
+            headerName.equalsIgnoreCase("Set-Cookie2")) {
       copyProxyCookie(servletRequest, servletResponse, headerValue);
-    } else if (headerName.equalsIgnoreCase(HttpHeaders.LOCATION)) {
+    } else if (headerName.equalsIgnoreCase("Location")) {
       // LOCATION Header may have to be rewritten.
       servletResponse.addHeader(headerName, rewriteUrlFromResponse(servletRequest, headerValue));
     } else {
@@ -665,40 +629,31 @@ protected String getCookieNamePrefix(String name) {
   }
 
   /** Copy response body data (the entity) from the proxy to the servlet client. */
-  protected void copyResponseEntity(HttpResponse proxyResponse, HttpServletResponse servletResponse,
+  protected void copyResponseEntity(HttpResponse<InputStream> proxyResponse, HttpServletResponse servletResponse,
                                     HttpRequest proxyRequest, HttpServletRequest servletRequest)
           throws IOException {
-    HttpEntity entity = proxyResponse.getEntity();
+    InputStream entity = proxyResponse.body();
     if (entity != null) {
-      if (entity.isChunked()) {
+      // Check if chunked based on headers
+      List<String> transferEncoding = proxyResponse.headers().allValues("Transfer-Encoding");
+      boolean isChunked = transferEncoding.stream().anyMatch(te -> te.toLowerCase().contains("chunked"));
+      
+      if (isChunked) {
         // Flush intermediate results before blocking on input -- needed for SSE
-        InputStream is = entity.getContent();
+        InputStream is = entity;
         OutputStream os = servletResponse.getOutputStream();
         byte[] buffer = new byte[10 * 1024];
         int read;
         while ((read = is.read(buffer)) != -1) {
           os.write(buffer, 0, read);
-          /*-
-           * Issue in Apache http client/JDK: if the stream from client is
-           * compressed, apache http client will delegate to GzipInputStream.
-           * The #available implementation of InflaterInputStream (parent of
-           * GzipInputStream) return 1 until EOF is reached. This is not
-           * consistent with InputStream#available, which defines:
-           *
-           *   A single read or skip of this many bytes will not block,
-           *   but may read or skip fewer bytes.
-           *
-           *  To work around this, a flush is issued always if compression
-            *  is handled by apache http client
-           */
+          // For chunked responses, always flush
           if (doHandleCompression || is.available() == 0 /* next is.read will block */) {
             os.flush();
           }
         }
-        // Entity closing/cleanup is done in the caller (#service)
       } else {
         OutputStream servletOutputStream = servletResponse.getOutputStream();
-        entity.writeTo(servletOutputStream);
+        entity.transferTo(servletOutputStream);
       }
     }
   }
diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
index b0e9da9..1efe630 100644
--- a/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
@@ -16,19 +16,16 @@
 
 package org.mitre.dsmiley.httpproxy;
 
-import org.apache.http.NameValuePair;
-import org.apache.http.client.utils.URIUtils;
-import org.apache.http.client.utils.URLEncodedUtils;
-
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.net.URLDecoder;
 import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 import java.util.LinkedHashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -93,16 +90,25 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     if (hash >= 0) {
       queryString = queryString.substring(0, hash);
     }
-    List<NameValuePair> pairs;
-    try {
-      //note: HttpClient 4.2 lets you parse the string without building the URI
-      pairs = URLEncodedUtils.parse(new URI(queryString), "UTF-8");
-    } catch (URISyntaxException e) {
-      throw new ServletException("Unexpected URI parsing error on " + queryString, e);
-    }
+    
     LinkedHashMap<String, String> params = new LinkedHashMap<String, String>();
-    for (NameValuePair pair : pairs) {
-      params.put(pair.getName(), pair.getValue());
+    if (requestQueryString != null && !requestQueryString.isEmpty()) {
+      // Parse query string manually
+      String[] pairs = requestQueryString.split("&");
+      for (String pair : pairs) {
+        int idx = pair.indexOf("=");
+        if (idx > 0) {
+          String key = URLDecoder.decode(pair.substring(0, idx), StandardCharsets.UTF_8);
+          String value = URLDecoder.decode(pair.substring(idx + 1), StandardCharsets.UTF_8);
+          params.put(key, value);
+        } else if (idx == 0) {
+          // Ignore malformed parameter
+        } else {
+          // Parameter without value
+          String key = URLDecoder.decode(pair, StandardCharsets.UTF_8);
+          params.put(key, "");
+        }
+      }
     }
 
     //Now rewrite the URL
@@ -125,7 +131,8 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     } catch (Exception e) {
       throw new ServletException("Rewritten targetUri is invalid: " + newTargetUri,e);
     }
-    servletRequest.setAttribute(ATTR_TARGET_HOST, URIUtils.extractHost(targetUriObj));
+    String targetHost = extractHost(targetUriObj);
+    servletRequest.setAttribute(ATTR_TARGET_HOST, targetHost);
 
     //Determine the new query string based on removing the used names
     StringBuilder newQueryBuf = new StringBuilder(queryString.length());
@@ -145,4 +152,16 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
   protected String rewriteQueryStringFromRequest(HttpServletRequest servletRequest, String queryString) {
     return (String) servletRequest.getAttribute(ATTR_QUERY_STRING);
   }
+  
+  /**
+   * Extract host:port from URI (helper method)
+   */
+  private String extractHost(URI uri) {
+    String host = uri.getHost();
+    int port = uri.getPort();
+    if (port == -1) {
+      return host;
+    }
+    return host + ":" + port;
+  }
 }

From 7827c09610c56842b178f290688a15cdf1eb3bf1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Nov 2025 13:38:14 +0000
Subject: [PATCH 03/15] Update test infrastructure to use Jetty and JDK
 HttpClient

- Replaced LocalTestServer with Jetty Server in ProxyServletTest
- Created RequestInfoServlet to replace RequestInfoHandler
- Updated test methods to use JDK HttpClient instead of Apache HttpClient
- Fixed ChunkedTransferTest to use JDK HttpClient
- Fixed AcceptEncodingTest to use JDK HttpClient
- Fixed ModifyHeadersProxyServletTest for new API
- Fixed URITemplateProxyServletTest references

Note: Some ProxyServletTest methods still need refactoring for dynamic
servlet registration - they currently don't compile.

Co-authored-by: dsmiley <377295+dsmiley@users.noreply.github.com>
---
 .../dsmiley/httpproxy/AcceptEncodingTest.java |  56 ++++----
 .../httpproxy/ChunkedTransferTest.java        |  69 +++++-----
 .../ModifyHeadersProxyServletTest.java        |  62 ++++++---
 .../dsmiley/httpproxy/ProxyServletTest.java   | 121 +++++++++++-------
 .../URITemplateProxyServletTest.java          |   4 +-
 5 files changed, 185 insertions(+), 127 deletions(-)

diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/AcceptEncodingTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/AcceptEncodingTest.java
index 04820e5..b30c85d 100644
--- a/src/test/java/org/mitre/dsmiley/httpproxy/AcceptEncodingTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/AcceptEncodingTest.java
@@ -23,13 +23,13 @@
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.HashSet;
-import org.apache.http.client.methods.CloseableHttpResponse;
-import org.apache.http.client.methods.HttpGet;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
 import org.eclipse.jetty.server.Handler;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
@@ -96,30 +96,36 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws Se
     });
     servletHandler.addServletWithMapping(dummyBackend, "/acceptEncoding/*");
 
-    HttpGet queryHandleCompression = new HttpGet(String.format("http://localhost:%d/acceptEncodingProxyHandleCompression/test", serverPort));
-    HttpGet query = new HttpGet(String.format("http://localhost:%d/acceptEncodingProxy/test", serverPort));
+    HttpRequest queryHandleCompression = HttpRequest.newBuilder()
+        .uri(URI.create(String.format("http://localhost:%d/acceptEncodingProxyHandleCompression/test", serverPort)))
+        .header("Accept-Encoding", "DummyCompression")
+        .GET()
+        .build();
+        
+    HttpRequest query = HttpRequest.newBuilder()
+        .uri(URI.create(String.format("http://localhost:%d/acceptEncodingProxy/test", serverPort)))
+        .header("Accept-Encoding", "DummyCompression")
+        .GET()
+        .build();
 
     final String dummyCompression = "DummyCompression";
 
-    query.setHeader("Accept-Encoding", dummyCompression);
-    queryHandleCompression.setHeader("Accept-Encoding", dummyCompression);
-
-    try (CloseableHttpClient chc = HttpClientBuilder.create().disableContentCompression().build();
-            CloseableHttpResponse responseHandleCompression = chc.execute(queryHandleCompression);
-            CloseableHttpResponse response = chc.execute(query);
-    ) {
-      try (InputStream is = response.getEntity().getContent()) {
-        byte[] readData = readBlock(is);
-        assertEquals(dummyCompression, toString(readData));
-      }
-      try (InputStream is = responseHandleCompression.getEntity().getContent()) {
-        byte[] readData = readBlock(is);
-        // Apache http client supports gzip and deflate by default
-        assertEquals(
-                new HashSet<>(Arrays.asList("gzip", "deflate")),
-                new HashSet<>(Arrays.asList(toString(readData).split("\\s*,\\s*")))
-        );
-      }
+    HttpClient client = HttpClient.newHttpClient();
+    
+    HttpResponse<InputStream> responseHandleCompression = client.send(queryHandleCompression, HttpResponse.BodyHandlers.ofInputStream());
+    HttpResponse<InputStream> response = client.send(query, HttpResponse.BodyHandlers.ofInputStream());
+    
+    try (InputStream is = response.body()) {
+      byte[] readData = readBlock(is);
+      assertEquals(dummyCompression, toString(readData));
+    }
+    try (InputStream is = responseHandleCompression.body()) {
+      byte[] readData = readBlock(is);
+      // JDK http client supports gzip by default
+      assertEquals(
+              new HashSet<>(Arrays.asList("gzip")),
+              new HashSet<>(Arrays.asList(toString(readData).split("\\s*,\\s*")))
+      );
     }
   }
 
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ChunkedTransferTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ChunkedTransferTest.java
index 91b538b..5be4e53 100644
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ChunkedTransferTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ChunkedTransferTest.java
@@ -18,6 +18,10 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.List;
@@ -27,11 +31,6 @@
 import jakarta.servlet.http.HttpServlet;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
-import org.apache.http.MalformedChunkCodingException;
-import org.apache.http.client.methods.CloseableHttpResponse;
-import org.apache.http.client.methods.HttpGet;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
 import org.eclipse.jetty.server.Handler;
 
 import org.eclipse.jetty.server.Server;
@@ -147,19 +146,22 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws Se
     });
     servletHandler.addServletWithMapping(dummyBackend, "/chat/*");
 
-    HttpGet url = new HttpGet(String.format("http://localhost:%d/chatProxied/test", serverPort));
-
-    try (CloseableHttpClient chc = HttpClientBuilder.create().build();
-            CloseableHttpResponse chr = chc.execute(url)) {
-      try (InputStream is = chr.getEntity().getContent()) {
-        byte[] readData = readBlock(is);
-        assertTrue("No data received (message1)", readData.length > 0);
-        assertArrayEquals("Received data: '" + toString(readData) + "'  (message1)", data1, readData);
-        guardForSecondRead.countDown();
-        readData = readBlock(is);
-        assertTrue("No data received  (message2)", readData.length > 0);
-        assertArrayEquals("Received data: '" + toString(readData) + "'  (message2)", data2, readData);
-      }
+    HttpRequest request = HttpRequest.newBuilder()
+        .uri(URI.create(String.format("http://localhost:%d/chatProxied/test", serverPort)))
+        .GET()
+        .build();
+
+    HttpClient client = HttpClient.newHttpClient();
+    HttpResponse<InputStream> response = client.send(request, HttpResponse.BodyHandlers.ofInputStream());
+    
+    try (InputStream is = response.body()) {
+      byte[] readData = readBlock(is);
+      assertTrue("No data received (message1)", readData.length > 0);
+      assertArrayEquals("Received data: '" + toString(readData) + "'  (message1)", data1, readData);
+      guardForSecondRead.countDown();
+      readData = readBlock(is);
+      assertTrue("No data received  (message2)", readData.length > 0);
+      assertArrayEquals("Received data: '" + toString(readData) + "'  (message2)", data2, readData);
     }
   }
 
@@ -217,21 +219,24 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws Se
     });
     servletHandler.addServletWithMapping(dummyBackend, "/chat/*");
 
-    HttpGet url = new HttpGet(String.format("http://localhost:%d/chatProxied/test", serverPort));
-
-    try (CloseableHttpClient chc = HttpClientBuilder.create().build()) {
-      CloseableHttpResponse chr = chc.execute(url);
-      try (InputStream is = chr.getEntity().getContent()) {
-        byte[] readData = readBlock(is);
-        assertTrue("No data received (message1)", readData.length > 0);
-        assertArrayEquals("Received data: '" + toString(readData) + "'  (message1)", data1, readData);
-        chr.close();
-      } catch (MalformedChunkCodingException ex) {
-        // this is expected
-      } finally {
-        chr.close();
-      }
+    HttpRequest request = HttpRequest.newBuilder()
+        .uri(URI.create(String.format("http://localhost:%d/chatProxied/test", serverPort)))
+        .GET()
+        .build();
+
+    HttpClient client = HttpClient.newHttpClient();
+    HttpResponse<InputStream> response = client.send(request, HttpResponse.BodyHandlers.ofInputStream());
+    
+    try (InputStream is = response.body()) {
+      byte[] readData = readBlock(is);
+      assertTrue("No data received (message1)", readData.length > 0);
+      assertArrayEquals("Received data: '" + toString(readData) + "'  (message1)", data1, readData);
+      // Close the stream early to test connection closing
+      is.close();
+    } catch (IOException ex) {
+      // this is expected - connection closed
     }
+    
     // Release sending of further messages
     guardForSecondRead.countDown();
     // Wait for the reporting of the closed connection
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ModifyHeadersProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ModifyHeadersProxyServletTest.java
index 66cc845..72679b9 100644
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ModifyHeadersProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ModifyHeadersProxyServletTest.java
@@ -18,16 +18,17 @@
 
 import com.meterware.httpunit.GetMethodWebRequest;
 import com.meterware.httpunit.WebResponse;
-import org.apache.http.Header;
-import org.apache.http.HttpException;
-import org.apache.http.HttpRequest;
-import org.apache.http.HttpResponse;
-import org.apache.http.protocol.HttpContext;
 import org.junit.Test;
 
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.net.http.HttpRequest;
+
+import org.eclipse.jetty.servlet.ServletHandler;
+import org.eclipse.jetty.servlet.ServletHolder;
 
 import static org.junit.Assert.assertEquals;
 
@@ -44,14 +45,24 @@ public void setUp() throws Exception {
 
   @Test
   public void testModifyRequestHeader() throws Exception {
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
-        Header headerToTest = request.getFirstHeader(ModifyHeadersProxyServlet.REQUEST_HEADER);
-        assertEquals("REQUEST_VALUE_MODIFIED", headerToTest.getValue());
-
-        super.handle(request, response, context);
+    // Stop the target server and restart with header checking servlet
+    targetServer.stop();
+    targetServer = new org.eclipse.jetty.server.Server(targetServerPort);
+    ServletHandler handler = new ServletHandler();
+    targetServer.setHandler(handler);
+    
+    ServletHolder holder = new ServletHolder(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        String headerValue = request.getHeader(ModifyHeadersProxyServlet.REQUEST_HEADER);
+        assertEquals("REQUEST_VALUE_MODIFIED", headerValue);
+        
+        // Call parent RequestInfoServlet behavior
+        new RequestInfoServlet().service(request, response);
       }
     });
+    handler.addServletWithMapping(holder, "/targetPath/*");
+    targetServer.start();
 
     GetMethodWebRequest req = makeGetMethodRequest(sourceBaseUri);
     req.setHeaderField(ModifyHeadersProxyServlet.REQUEST_HEADER, "INITIAL_VALUE");
@@ -61,12 +72,23 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
 
   @Test
   public void testModifyResponseHeader() throws Exception {
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    // Stop the target server and restart with header setting servlet
+    targetServer.stop();
+    targetServer = new org.eclipse.jetty.server.Server(targetServerPort);
+    ServletHandler handler = new ServletHandler();
+    targetServer.setHandler(handler);
+    
+    ServletHolder holder = new ServletHolder(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(ModifyHeadersProxyServlet.RESPONSE_HEADER, "INITIAL_VALUE");
-        super.handle(request, response, context);
+        
+        // Call parent RequestInfoServlet behavior
+        new RequestInfoServlet().service(request, response);
       }
     });
+    handler.addServletWithMapping(holder, "/targetPath/*");
+    targetServer.start();
 
     GetMethodWebRequest req = makeGetMethodRequest(sourceBaseUri);
     WebResponse rsp = execAndAssert(req, "");
@@ -80,9 +102,9 @@ public static class ModifyHeadersProxyServlet extends ProxyServlet {
     public static final String RESPONSE_HEADER = "RESPONSE_HEADER";
 
     @Override
-    protected void copyRequestHeader(HttpServletRequest servletRequest, HttpRequest proxyRequest, String headerName) {
+    protected void copyRequestHeader(HttpServletRequest servletRequest, HttpRequest.Builder proxyRequest, String headerName) {
       if (REQUEST_HEADER.equalsIgnoreCase(headerName)) {
-        proxyRequest.addHeader(headerName, "REQUEST_VALUE_MODIFIED");
+        proxyRequest.header(headerName, "REQUEST_VALUE_MODIFIED");
       } else {
         super.copyRequestHeader(servletRequest, proxyRequest, headerName);
       }
@@ -90,11 +112,11 @@ protected void copyRequestHeader(HttpServletRequest servletRequest, HttpRequest
 
     @Override
     protected void copyResponseHeader(HttpServletRequest servletRequest,
-                                      HttpServletResponse servletResponse, Header header) {
-      if (RESPONSE_HEADER.equalsIgnoreCase(header.getName())) {
-        servletResponse.addHeader(header.getName(), "RESPONSE_VALUE_MODIFIED");
+                                      HttpServletResponse servletResponse, String headerName, String headerValue) {
+      if (RESPONSE_HEADER.equalsIgnoreCase(headerName)) {
+        servletResponse.addHeader(headerName, "RESPONSE_VALUE_MODIFIED");
       } else {
-        super.copyResponseHeader(servletRequest, servletResponse, header);
+        super.copyResponseHeader(servletRequest, servletResponse, headerName, headerValue);
       }
     }
 
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index d1279a4..4ce8283 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -35,22 +35,17 @@
 import java.util.Properties;
 import java.util.concurrent.atomic.AtomicInteger;
 
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.apache.http.Header;
-import org.apache.http.HttpEntity;
-import org.apache.http.HttpEntityEnclosingRequest;
-import org.apache.http.HttpException;
-import org.apache.http.HttpHeaders;
-import org.apache.http.HttpRequest;
-import org.apache.http.HttpResponse;
-import org.apache.http.HttpStatus;
-import org.apache.http.RequestLine;
-import org.apache.http.entity.ByteArrayEntity;
-import org.apache.http.localserver.LocalTestServer;
-import org.apache.http.protocol.HttpContext;
-import org.apache.http.protocol.HttpRequestHandler;
-import org.apache.http.util.EntityUtils;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.ServerConnector;
+import org.eclipse.jetty.servlet.ServletHandler;
+import org.eclipse.jetty.servlet.ServletHolder;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
@@ -72,10 +67,10 @@ public class ProxyServletTest
   private static final Log log = LogFactory.getLog(ProxyServletTest.class);
 
   /**
-   * From Apache httpcomponents/httpclient. Note httpunit has a similar thing called PseudoServlet but it is
-   * not as good since you can't even make it echo the request back.
+   * Jetty server for target backend
    */
-  protected LocalTestServer localTestServer;
+  protected Server targetServer;
+  protected int targetServerPort;
 
   /** From Meterware httpunit. */
   protected ServletRunner servletRunner;
@@ -89,9 +84,13 @@ public class ProxyServletTest
 
   @Before
   public void setUp() throws Exception {
-    localTestServer = new LocalTestServer(null, null);
-    localTestServer.start();
-    localTestServer.register("/targetPath*", new RequestInfoHandler());//matches /targetPath and /targetPath/blahblah
+    // Start Jetty server as target
+    targetServer = new Server(0);
+    ServletHandler handler = new ServletHandler();
+    targetServer.setHandler(handler);
+    handler.addServletWithMapping(RequestInfoServlet.class, "/targetPath/*");
+    targetServer.start();
+    targetServerPort = ((ServerConnector) targetServer.getConnectors()[0]).getLocalPort();
 
     servletRunner = new ServletRunner();
 
@@ -108,7 +107,7 @@ public void setUp() throws Exception {
 
   protected void setUpServlet(Properties servletProps) {
     servletProps.putAll(servletProps);
-    targetBaseUri = "http://localhost:"+localTestServer.getServiceAddress().getPort()+"/targetPath";
+    targetBaseUri = "http://localhost:" + targetServerPort + "/targetPath";
     servletProps.setProperty("targetUri", targetBaseUri);
     servletRunner.registerServlet(servletPath + "/*", servletName, servletProps);//also matches /proxyMe (no path info)
     sourceBaseUri = "http://localhost/proxyMe";//localhost:0 is hard-coded in ServletUnitHttpRequest
@@ -117,7 +116,9 @@ protected void setUpServlet(Properties servletProps) {
   @After
   public void tearDown() throws Exception {
    servletRunner.shutDown();
-   localTestServer.stop();
+   if (targetServer != null) {
+     targetServer.stop();
+   }
   }
 
   //note: we don't include fragments:   "/p?#f","/p?#" because
@@ -158,16 +159,30 @@ public void testPost() throws Exception {
   }
 
   @Test
-  public void testRedirect() throws IOException, SAXException {
+  public void testRedirect() throws Exception {
     final String COOKIE_SET_HEADER = "Set-Cookie";
-    localTestServer.register("/targetPath*",new HttpRequestHandler()
-    {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
-        response.setHeader(HttpHeaders.LOCATION,request.getFirstHeader("xxTarget").getValue());
-        response.setHeader(COOKIE_SET_HEADER,"JSESSIONID=1234; path=/;");
-        response.setStatusCode(HttpStatus.SC_MOVED_TEMPORARILY);
+    
+    // Stop the target server and restart with redirect servlet
+    targetServer.stop();
+    targetServer = new Server(targetServerPort);
+    ServletHandler handler = new ServletHandler();
+    targetServer.setHandler(handler);
+    
+    // Add a redirect servlet
+    ServletHolder redirectHolder = new ServletHolder(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        String targetHeader = request.getHeader("xxTarget");
+        if (targetHeader != null) {
+          response.setHeader("Location", targetHeader);
+          response.setHeader(COOKIE_SET_HEADER, "JSESSIONID=1234; path=/;");
+          response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);
+        }
       }
-    });//matches /targetPath and /targetPath/blahblah
+    });
+    handler.addServletWithMapping(redirectHolder, "/targetPath/*");
+    targetServer.start();
+    
     GetMethodWebRequest request = makeGetMethodRequest(sourceBaseUri + "/%64%69%72%2F");
     assertRedirect(request, "/dummy", "/dummy");//TODO represents a bug to fix
     assertRedirect(request, targetBaseUri+"/dummy?a=b", sourceBaseUri+"/dummy?a=b");
@@ -187,9 +202,9 @@ private void assertRedirect(GetMethodWebRequest request, String origRedirect, St
     request.setHeaderField("xxTarget", origRedirect);
     WebResponse rsp = sc.getResponse(request);
 
-    assertEquals(HttpStatus.SC_MOVED_TEMPORARILY,rsp.getResponseCode());
+    assertEquals(HttpServletResponse.SC_MOVED_TEMPORARILY,rsp.getResponseCode());
     assertEquals("",rsp.getText());
-    String gotLocation = rsp.getHeaderField(HttpHeaders.LOCATION);
+    String gotLocation = rsp.getHeaderField("Location");
     assertEquals(resultRedirect, gotLocation);
     assertEquals("!Proxy!"+servletName+"JSESSIONID=1234;path="+servletPath,rsp.getHeaderField("Set-Cookie"));
   }
@@ -660,31 +675,41 @@ protected String rewriteMakeMethodUrl(String url) {
   /**
    * Writes all information about the request back to the response.
    */
-  protected static class RequestInfoHandler implements HttpRequestHandler
+  public static class RequestInfoServlet extends HttpServlet
   {
-
-    public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    @Override
+    protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
       ByteArrayOutputStream baos = new ByteArrayOutputStream();
       PrintWriter pw = new PrintWriter(baos,false);
-      final RequestLine rl = request.getRequestLine();
-      pw.println("REQUESTLINE: " + rl);
-
-      for (Header header : request.getAllHeaders()) {
-        pw.println(header.getName() + ": " + header.getValue());
+      
+      pw.println("REQUESTLINE: " + request.getMethod() + " " + request.getRequestURI() + 
+                 (request.getQueryString() != null ? "?" + request.getQueryString() : "") + 
+                 " " + request.getProtocol());
+
+      Enumeration<String> headerNames = request.getHeaderNames();
+      while (headerNames.hasMoreElements()) {
+        String headerName = headerNames.nextElement();
+        Enumeration<String> headerValues = request.getHeaders(headerName);
+        while (headerValues.hasMoreElements()) {
+          pw.println(headerName + ": " + headerValues.nextElement());
+        }
       }
       pw.println("BODY: (below)");
       pw.flush();//done with pw now
 
-      if (request instanceof HttpEntityEnclosingRequest) {
-        HttpEntityEnclosingRequest enclosingRequest = (HttpEntityEnclosingRequest) request;
-        HttpEntity entity = enclosingRequest.getEntity();
-        byte[] body = EntityUtils.toByteArray(entity);
-        baos.write(body);
+      // Copy request body
+      InputStream is = request.getInputStream();
+      byte[] buffer = new byte[8192];
+      int bytesRead;
+      while ((bytesRead = is.read(buffer)) != -1) {
+        baos.write(buffer, 0, bytesRead);
       }
 
-      response.setStatusCode(200);
-      response.setReasonPhrase("TESTREASON");
-      response.setEntity(new ByteArrayEntity(baos.toByteArray()));
+      response.setStatus(200);
+      response.setHeader("X-Reason", "TESTREASON");
+      response.setContentType("text/plain");
+      response.setContentLength(baos.size());
+      response.getOutputStream().write(baos.toByteArray());
     }
   }
 }
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServletTest.java
index d5c7e70..728d56e 100644
--- a/src/test/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServletTest.java
@@ -47,9 +47,9 @@ public void setUp() throws Exception {
   @Override
   protected void setUpServlet(Properties servletProps) {
     //Register a parameterized proxy servlet.
-    // for the test, host should be localhost, $2 should be localTestServer port, and path should be targetPath
+    // for the test, host should be localhost, $2 should be targetServerPort, and path should be targetPath
     String hostParam = "localhost";
-    String portParam = String.valueOf(localTestServer.getServiceAddress().getPort());
+    String portParam = String.valueOf(targetServerPort);
     String pathParam = "targetPath";
     urlParams = "_host=" + hostParam + "&_port=" + portParam + "&_path=" + pathParam;
     targetBaseUri = "http://" + hostParam + ":" + portParam + "/" + pathParam;

From 1912709e3d67d15ee4e199e6d5ce40127f136b50 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Nov 2025 13:40:16 +0000
Subject: [PATCH 04/15] Add replaceTargetServlet helper and fix more tests

- Added replaceTargetServlet() helper method for test customization
- Fixed testHopByHopHeadersOnSource
- Fixed testWithExistingXForwardedFor
- Fixed testEnabledXForwardedFor

Remaining work: ~11 more tests need similar conversion

Co-authored-by: dsmiley <377295+dsmiley@users.noreply.github.com>
---
 .../dsmiley/httpproxy/ProxyServletTest.java   | 49 +++++++++++++------
 1 file changed, 33 insertions(+), 16 deletions(-)

diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index 4ce8283..1f5b807 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -104,6 +104,19 @@ public void setUp() throws Exception {
     sc.getClientProperties().setAutoRedirect(false);//don't want httpunit itself to redirect
 
   }
+  
+  /**
+   * Helper to restart target server with a custom servlet
+   */
+  protected void replaceTargetServlet(HttpServlet servlet) throws Exception {
+    targetServer.stop();
+    targetServer = new Server(targetServerPort);
+    ServletHandler handler = new ServletHandler();
+    targetServer.setHandler(handler);
+    ServletHolder holder = new ServletHolder(servlet);
+    handler.addServletWithMapping(holder, "/targetPath/*");
+    targetServer.start();
+  }
 
   protected void setUpServlet(Properties servletProps) {
     servletProps.putAll(servletProps);
@@ -233,11 +246,13 @@ public void testProxyWithUnescapedChars() throws Exception {
   public void testHopByHopHeadersOnSource() throws Exception {
     //"Proxy-Authenticate" is a hop-by-hop header
     final String HEADER = "Proxy-Authenticate";
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
-        assertNull(request.getFirstHeader(HEADER));
+    
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        assertNull(request.getHeader(HEADER));
         response.setHeader(HEADER, "from-server");
-        super.handle(request, response, context);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -251,11 +266,12 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
   public void testWithExistingXForwardedFor() throws Exception {
     final String FOR_HEADER = "X-Forwarded-For";
 
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
-        Header xForwardedForHeader = request.getFirstHeader(FOR_HEADER);
-        assertEquals("192.168.1.1, 127.0.0.1", xForwardedForHeader.getValue());
-        super.handle(request, response, context);
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        String xForwardedForHeader = request.getHeader(FOR_HEADER);
+        assertEquals("192.168.1.1, 127.0.0.1", xForwardedForHeader);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -269,13 +285,14 @@ public void testEnabledXForwardedFor() throws Exception {
     final String FOR_HEADER = "X-Forwarded-For";
     final String PROTO_HEADER = "X-Forwarded-Proto";
 
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
-        Header xForwardedForHeader = request.getFirstHeader(FOR_HEADER);
-        Header xForwardedProtoHeader = request.getFirstHeader(PROTO_HEADER);
-        assertEquals("127.0.0.1", xForwardedForHeader.getValue());
-        assertEquals("http", xForwardedProtoHeader.getValue());
-        super.handle(request, response, context);
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        String xForwardedForHeader = request.getHeader(FOR_HEADER);
+        String xForwardedProtoHeader = request.getHeader(PROTO_HEADER);
+        assertEquals("127.0.0.1", xForwardedForHeader);
+        assertEquals("http", xForwardedProtoHeader);
+        new RequestInfoServlet().service(request, response);
       }
     });
 

From ee6ec5b38906df05c57eb2fa3825ffb2c8b2edde Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Nov 2025 13:44:47 +0000
Subject: [PATCH 05/15] Complete test conversion - all tests now compile and
 run

- Fixed all remaining localTestServer.register calls
- Converted all tests to use replaceTargetServlet() or inline servlets
- Fixed all Apache HttpClient API references (HttpStatus, HttpHeaders, etc.)
- Tests now compile successfully
- 72 tests run: 56 pass, 9 fail, 7 errors, 2 skipped

Most tests passing! Remaining failures likely need minor tweaks to handle
differences between Apache HttpClient and JDK HttpClient behavior.

Co-authored-by: dsmiley <377295+dsmiley@users.noreply.github.com>
---
 .../dsmiley/httpproxy/ProxyServletTest.java   | 113 ++++++++++--------
 1 file changed, 65 insertions(+), 48 deletions(-)

diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index 1f5b807..806e5df 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -304,12 +304,12 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testCopyRequestHeaderToProxyRequest() throws Exception {
     final String HEADER = "HEADER_TO_TEST";
 
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
-        Header headerToTest = request.getFirstHeader(HEADER);
-        assertEquals("VALUE_TO_TEST", headerToTest.getValue());
-
-        super.handle(request, response, context);
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        String headerToTest = request.getHeader(HEADER);
+        assertEquals("VALUE_TO_TEST", headerToTest);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -323,10 +323,11 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
   public void testCopyProxiedRequestHeadersToResponse() throws Exception {
     final String HEADER = "HEADER_TO_TEST";
 
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "VALUE_TO_TEST");
-        super.handle(request, response, context);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -339,10 +340,11 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
   @Test
   public void testSetCookie() throws Exception {
     final String HEADER = "Set-Cookie";
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
-        super.handle(request, response, context);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -355,10 +357,11 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
   @Test
   public void testSetCookie2() throws Exception {
     final String HEADER = "Set-Cookie2";
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Max-Age=3600; Domain=.foo.bar.com; Secure");
-        super.handle(request, response, context);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -384,10 +387,11 @@ public void testPreserveCookie() throws Exception {
     sc.getClientProperties().setAutoRedirect(false);//don't want httpunit itself to redirect
 
     final String HEADER = "Set-Cookie";
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
-        super.handle(request, response, context);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -400,10 +404,11 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
   @Test
   public void testSetCookieHttpOnly() throws Exception { //See GH #50
     final String HEADER = "Set-Cookie";
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want/; HttpOnly");
-        super.handle(request, response, context);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -417,10 +422,11 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
   public void testSendCookiesToProxy() throws Exception {
     final StringBuffer captureCookieValue = new StringBuffer();
     final String HEADER = "Cookie";
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
-        captureCookieValue.append(request.getHeaders(HEADER)[0].getValue());
-        super.handle(request, response, context);
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        captureCookieValue.append(request.getHeader(HEADER));
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -450,10 +456,11 @@ public void testPreserveCookiePath() throws Exception {
     sc.getClientProperties().setAutoRedirect(false);//don't want httpunit itself to redirect
 
     final String HEADER = "Set-Cookie";
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
-        super.handle(request, response, context);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -472,15 +479,16 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
   public void testMultipleRequestsWithDiffCookies() throws Exception {
     final AtomicInteger requestCounter = new AtomicInteger(1);
     final StringBuffer captureCookieValue = new StringBuffer();
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         // there shouldn't be a cookie sent since each user request in this test is logging in for the first time
-        if (request.getFirstHeader("Cookie") != null) {
-            captureCookieValue.append(request.getFirstHeader("Cookie"));
+        if (request.getHeader("Cookie") != null) {
+            captureCookieValue.append(request.getHeader("Cookie"));
         } else {
             response.setHeader("Set-Cookie", "JSESSIONID=USER_" + requestCounter.getAndIncrement() + "_SESSION");
         }
-        super.handle(request, response, context);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -501,28 +509,36 @@ public void handle(HttpRequest request, HttpResponse response, HttpContext conte
   @Test
   public void testRedirectWithBody() throws Exception {
     final String CONTENT = "-This-Shall-Not-Pass-";
-	localTestServer.register("/targetPath/test",new HttpRequestHandler()
-    {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
+    
+    // Stop and restart with a custom servlet for the redirect test
+    targetServer.stop();
+    targetServer = new Server(targetServerPort);
+    ServletHandler handler = new ServletHandler();
+    targetServer.setHandler(handler);
+    ServletHolder holder = new ServletHolder(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         // Redirect to the requested URL with / appended
-        response.setHeader(HttpHeaders.LOCATION, targetBaseUri + "/test/");
-        response.setStatusCode(HttpStatus.SC_MOVED_TEMPORARILY);
-        response.setHeader(HttpHeaders.CONTENT_TYPE, "text/plain; charset=UTF-8");
+        response.setHeader("Location", targetBaseUri + "/test/");
+        response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);
+        response.setHeader("Content-Type", "text/plain; charset=UTF-8");
         // Set body of the response. We need it not-empty for the test.
-        response.setEntity(new ByteArrayEntity(CONTENT.getBytes("UTF-8")));
+        response.getOutputStream().write(CONTENT.getBytes("UTF-8"));
       }
     });
+    handler.addServletWithMapping(holder, "/targetPath/test");
+    targetServer.start();
     GetMethodWebRequest req = makeGetMethodRequest(sourceBaseUri + "/test");
     // We expect a redirect with a / at the end
     WebResponse rsp = sc.getResponse(req);
 
     // Expect the same status code as the handler.
-    assertEquals(HttpStatus.SC_MOVED_TEMPORARILY, rsp.getResponseCode());
+    assertEquals(HttpServletResponse.SC_MOVED_TEMPORARILY, rsp.getResponseCode());
     // Expect exact Content-Length
-    assertEquals(String.valueOf(CONTENT.length()), rsp.getHeaderField(HttpHeaders.CONTENT_LENGTH));
+    assertEquals(String.valueOf(CONTENT.length()), rsp.getHeaderField("Content-Length"));
     // Expect exact response
     assertEquals(CONTENT, rsp.getText());
-    assertEquals(sourceBaseUri + "/test/", rsp.getHeaderField(HttpHeaders.LOCATION));
+    assertEquals(sourceBaseUri + "/test/", rsp.getHeaderField("Location"));
   }
 
   @Test
@@ -541,10 +557,11 @@ public void testPreserveHost() throws Exception {
 
     final String HEADER = "Host";
     final String[] proxyHost = new String[1];
-    localTestServer.register("/targetPath*", new RequestInfoHandler() {
-      public void handle(HttpRequest request, HttpResponse response, HttpContext context) throws HttpException, IOException {
-    	  proxyHost[0] = request.getHeaders(HEADER)[0].getValue();
-        super.handle(request, response, context);
+    replaceTargetServlet(new HttpServlet() {
+      @Override
+      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+    	  proxyHost[0] = request.getHeader(HEADER);
+        new RequestInfoServlet().service(request, response);
       }
     });
 
@@ -601,7 +618,7 @@ private WebResponse execAndAssert(PostMethodWebRequest request) throws Exception
   protected WebResponse execAndAssert(WebRequest request, String expectedUri) throws Exception {
     WebResponse rsp = sc.getResponse( request );
 
-    assertEquals(HttpStatus.SC_OK,rsp.getResponseCode());
+    assertEquals(HttpServletResponse.SC_OK,rsp.getResponseCode());
     //HttpUnit doesn't pass the message; not a big deal
     //assertEquals("TESTREASON",rsp.getResponseMessage());
     final String text = rsp.getText();

From 395d33472a34abb20ec885bb736b74d5bd77d405 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Nov 2025 13:45:27 +0000
Subject: [PATCH 06/15] Update README to reflect JDK 11 HttpClient migration

- Removed references to Apache HttpClient dependency
- Updated documentation to state proxy is now dependency-free
- Kept reference to previous Apache HttpClient versions for historical context

Co-authored-by: dsmiley <377295+dsmiley@users.noreply.github.com>
---
 README.md | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index 51fa79e..b6d12aa 100644
--- a/README.md
+++ b/README.md
@@ -18,19 +18,8 @@ I suggest you use a well tested proxy instead of something non-tested that is pe
 
 If you need something more sophisticated than there are some alternatives listed at the bottom of this page.
 
-This proxy depends on [Apache HttpClient](http://hc.apache.org/httpcomponents-client-ga/), which offers another point of extension for this proxy.
-At some point I may write an alternative that uses the JDK and thus doesn't have any dependencies, which is desirable.
-In the meantime, you'll have to add the jar files for this and its dependencies:
-
-     +- org.apache.httpcomponents:httpclient:jar:4.5.13:compile
-        +- org.apache.httpcomponents:httpcore:jar:4.4.13:compile
-        |  +- commons-logging:commons-logging:jar:1.2:compile
-        |  \- commons-codec:commons-codec:jar:1.11:compile
-
-This proxy supports HttpClient 4.5, and newer version too.
-If you need to support _older_ HttpClient versions:
-* use 1.8 version of this proxy for HttpClient versions 4.1 and 4.2
-* use 1.12 version of this proxy for HttpClient versions 4.3 and 4.4
+This proxy now uses the JDK 11 HttpClient and is dependency-free (aside from the servlet API). 
+Previous versions used Apache HttpClient.
 
 As of version 2.0 of the proxy, the proxy switched to the `jakarta servlet-api`, while nonetheless retaining support for the `javax servlet-api` version for those that need it.  To use that, specify the `javax` classifier on the dependency declaration as follows:
 ```xml

From 9627bc53e62a5f3cc9a6ff3f55671cb574a58f31 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Nov 2025 19:35:17 +0000
Subject: [PATCH 07/15] Address code review feedback

- Updated destroy() to check for AutoCloseable and close HttpClient (Java 21+)
- Restored valuable comments about protocol version and chunked responses
- Restored detailed comment about compression and InputStream.available()
- Changed hopByHopHeaders to use Set.of() for immutability
- Used Locale.ROOT for all toLowerCase() calls
- Optimized copyResponseHeaders to iterate map entries directly
- Removed unimplementable P_ constants (P_CONNECTIONREQUESTTIMEOUT, P_MAXCONNECTIONS, P_USESYSTEMPROPERTIES)
- Marked related tests as @Ignore with explanations
- Removed redundant close in handleRequestException (already in finally block)

Co-authored-by: dsmiley <377295+dsmiley@users.noreply.github.com>
---
 .../mitre/dsmiley/httpproxy/ProxyServlet.java | 89 +++++++++----------
 .../httpproxy/ParallelConnectionsTest.java    |  3 +-
 .../dsmiley/httpproxy/ProxyServletTest.java   |  3 +-
 3 files changed, 44 insertions(+), 51 deletions(-)

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index 7c0f360..9ff4531 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -33,8 +33,8 @@
 import java.util.BitSet;
 import java.util.Enumeration;
 import java.util.Formatter;
-import java.util.HashSet;
 import java.util.List;
+import java.util.Locale;
 import java.util.Set;
 
 /**
@@ -80,15 +80,6 @@ public class ProxyServlet extends HttpServlet {
   /** An integer parameter name to set the socket read timeout (millis) */
   public static final String P_READTIMEOUT = "http.read.timeout";
 
-  /** An integer parameter name to set the connection request timeout (millis) */
-  public static final String P_CONNECTIONREQUESTTIMEOUT = "http.connectionrequest.timeout";
-
-  /** An integer parameter name to set max connection number */
-  public static final String P_MAXCONNECTIONS = "http.maxConnections";
-
-  /** A boolean parameter whether to use JVM-defined system properties to configure various networking aspects. */
-  public static final String P_USESYSTEMPROPERTIES = "useSystemProperties";
-
   /** A boolean parameter to enable handling of compression in the servlet. If it is false, compressed streams are passed through unmodified. */
   public static final String P_HANDLECOMPRESSION = "handleCompression";
 
@@ -110,12 +101,9 @@ public class ProxyServlet extends HttpServlet {
   protected boolean doPreserveCookies = false;
   protected boolean doPreserveCookiePath = false;
   protected boolean doHandleRedirects = false;
-  protected boolean useSystemProperties = true;
   protected boolean doHandleCompression = false;
   protected int connectTimeout = -1;
   protected int readTimeout = -1;
-  protected int connectionRequestTimeout = -1;
-  protected int maxConnections = -1;
 
   //These next 3 are cached here, and should only be referred to in initialization logic. See the
   // ATTR_* parameters.
@@ -190,21 +178,6 @@ public void init() throws ServletException {
       this.readTimeout = Integer.parseInt(readTimeoutString);
     }
 
-    String connectionRequestTimeout = getConfigParam(P_CONNECTIONREQUESTTIMEOUT);
-    if (connectionRequestTimeout != null) {
-      this.connectionRequestTimeout = Integer.parseInt(connectionRequestTimeout);
-    }
-
-    String maxConnections = getConfigParam(P_MAXCONNECTIONS);
-    if (maxConnections != null) {
-      this.maxConnections = Integer.parseInt(maxConnections);
-    }
-
-    String useSystemPropertiesString = getConfigParam(P_USESYSTEMPROPERTIES);
-    if (useSystemPropertiesString != null) {
-      this.useSystemProperties = Boolean.parseBoolean(useSystemPropertiesString);
-    }
-
     String doHandleCompression = getConfigParam(P_HANDLECOMPRESSION);
     if (doHandleCompression != null) {
       this.doHandleCompression = Boolean.parseBoolean(doHandleCompression);
@@ -231,9 +204,6 @@ protected HttpClient.Builder buildClientBuilder() {
       builder.connectTimeout(Duration.ofMillis(connectTimeout));
     }
     
-    // Note: JDK HttpClient doesn't have direct equivalents for all Apache HttpClient settings
-    // like connection request timeout or max connections per route
-    
     return builder;
   }
 
@@ -305,7 +275,14 @@ protected HttpClient getProxyClient() {
 
   @Override
   public void destroy() {
-    // JDK HttpClient doesn't need explicit cleanup
+    //Usually, clients implement Closeable (as of Java 21+):
+    if (proxyClient instanceof AutoCloseable) {
+      try {
+        ((AutoCloseable) proxyClient).close();
+      } catch (Exception e) {
+        log("While destroying servlet, shutting down HttpClient: "+e, e);
+      }
+    }
     super.destroy();
   }
 
@@ -321,6 +298,7 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     }
 
     // Make the Request
+    //note: we won't transfer the protocol version because I'm not sure it would truly be compatible
     String method = servletRequest.getMethod();
     String proxyRequestUri = rewriteUrlFromRequest(servletRequest);
     
@@ -380,7 +358,7 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     } catch (Exception e) {
       handleRequestException(proxyRequest, proxyResponse, e);
     } finally {
-      // Close response body if present
+      // make sure the entire entity was consumed, so the connection is released
       if (proxyResponse != null && proxyResponse.body() != null) {
         try {
           proxyResponse.body().close();
@@ -388,11 +366,16 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
           // Ignore
         }
       }
+      //Note: Don't need to close servlet outputStream:
+      // http://stackoverflow.com/questions/1159168/should-one-call-close-on-httpservletresponse-getoutputstream-getwriter
     }
   }
 
   protected void handleRequestException(HttpRequest proxyRequest, HttpResponse<InputStream> proxyResponse, Exception e) throws ServletException, IOException {
-    // Close the response if present
+    // If the response is a chunked response, it is read to completion when
+    // #close is called. If the sending site does not timeout or keeps sending,
+    // the connection will be kept open indefinitely. Closing the response
+    // object terminates the stream.
     if (proxyResponse != null && proxyResponse.body() != null) {
       try {
         proxyResponse.body().close();
@@ -436,16 +419,10 @@ private long getContentLength(HttpServletRequest request) {
   /** These are the "hop-by-hop" headers that should not be copied.
    * http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
    */
-  protected static final Set<String> hopByHopHeaders;
-  static {
-    hopByHopHeaders = new HashSet<>();
-    String[] headers = new String[] {
-        "Connection", "Keep-Alive", "Proxy-Authenticate", "Proxy-Authorization",
-        "TE", "Trailers", "Transfer-Encoding", "Upgrade" };
-    for (String header : headers) {
-      hopByHopHeaders.add(header.toLowerCase());
-    }
-  }
+  protected static final Set<String> hopByHopHeaders = Set.of(
+      "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
+      "te", "trailers", "transfer-encoding", "upgrade"
+  );
 
   /**
    * Copy request headers from the servlet client to the proxy request.
@@ -470,7 +447,7 @@ protected void copyRequestHeader(HttpServletRequest servletRequest, HttpRequest.
     //Instead the content-length is effectively set via InputStreamEntity
     if (headerName.equalsIgnoreCase("Content-Length"))
       return;
-    if (hopByHopHeaders.contains(headerName.toLowerCase()))
+    if (hopByHopHeaders.contains(headerName.toLowerCase(Locale.ROOT)))
       return;
     // If compression is handled in the servlet, JDK http client needs to
     // control the Accept-Encoding header, not the client
@@ -513,8 +490,9 @@ private void setXForwardedForHeader(HttpServletRequest servletRequest,
   /** Copy proxied response headers back to the servlet client. */
   protected void copyResponseHeaders(HttpResponse<InputStream> proxyResponse, HttpServletRequest servletRequest,
                                      HttpServletResponse servletResponse) {
-    for (String headerName : proxyResponse.headers().map().keySet()) {
-      for (String headerValue : proxyResponse.headers().allValues(headerName)) {
+    for (var entry : proxyResponse.headers().map().entrySet()) {
+      String headerName = entry.getKey();
+      for (String headerValue : entry.getValue()) {
         copyResponseHeader(servletRequest, servletResponse, headerName, headerValue);
       }
     }
@@ -525,7 +503,7 @@ protected void copyResponseHeaders(HttpResponse<InputStream> proxyResponse, Http
    */
   protected void copyResponseHeader(HttpServletRequest servletRequest,
                                   HttpServletResponse servletResponse, String headerName, String headerValue) {
-    if (hopByHopHeaders.contains(headerName.toLowerCase()))
+    if (hopByHopHeaders.contains(headerName.toLowerCase(Locale.ROOT)))
       return;
     if (headerName.equalsIgnoreCase("Set-Cookie") ||
             headerName.equalsIgnoreCase("Set-Cookie2")) {
@@ -646,11 +624,24 @@ protected void copyResponseEntity(HttpResponse<InputStream> proxyResponse, HttpS
         int read;
         while ((read = is.read(buffer)) != -1) {
           os.write(buffer, 0, read);
-          // For chunked responses, always flush
+          /*-
+           * Issue in JDK HttpClient: if the stream from client is
+           * compressed, it may delegate to GzipInputStream.
+           * The #available implementation of InflaterInputStream (parent of
+           * GzipInputStream) return 1 until EOF is reached. This is not
+           * consistent with InputStream#available, which defines:
+           *
+           *   A single read or skip of this many bytes will not block,
+           *   but may read or skip fewer bytes.
+           *
+           *  To work around this, a flush is issued always if compression
+            *  is handled by the http client
+           */
           if (doHandleCompression || is.available() == 0 /* next is.read will block */) {
             os.flush();
           }
         }
+        // Entity closing/cleanup is done in the caller (#service)
       } else {
         OutputStream servletOutputStream = servletResponse.getOutputStream();
         entity.transferTo(servletOutputStream);
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ParallelConnectionsTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ParallelConnectionsTest.java
index 967b93b..0fb367a 100644
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ParallelConnectionsTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ParallelConnectionsTest.java
@@ -68,6 +68,7 @@ public void tearDown() throws Exception {
   }
 
   @Test
+  @org.junit.Ignore("P_MAXCONNECTIONS not supported with JDK HttpClient")
   public void testHandlingMultipleConnectionsSameRoute() throws Exception {
     /*
      This test ensures, that a minimum nunmber of parallel connections can be
@@ -81,7 +82,7 @@ public void testHandlingMultipleConnectionsSameRoute() throws Exception {
 
     ServletHolder servletHolder = servletHandler.addServletWithMapping(ProxyServlet.class, "/sampleBackendProxied/*");
     servletHolder.setInitParameter(ProxyServlet.P_LOG, "true");
-    servletHolder.setInitParameter(ProxyServlet.P_MAXCONNECTIONS, Integer.toString(parallelConnectionsToTest));
+    // servletHolder.setInitParameter(ProxyServlet.P_MAXCONNECTIONS, Integer.toString(parallelConnectionsToTest)); // Not supported with JDK HttpClient
     servletHolder.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/sampleBackend/", serverPort));
 
     CountDownLatch requestsReceived = new CountDownLatch(parallelConnectionsToTest);
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index 806e5df..6ca063b 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -572,13 +572,14 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   }
 
   @Test
+  @org.junit.Ignore("P_USESYSTEMPROPERTIES not supported with JDK HttpClient")
   public void testUseSystemProperties() throws Exception {
     System.setProperty("http.proxyHost", "foo.blah.nonexisting.dns.name");
     servletRunner = new ServletRunner();
 
     Properties servletProps = new Properties();
     servletProps.setProperty(ProxyServlet.P_LOG, "true");
-    servletProps.setProperty(ProxyServlet.P_USESYSTEMPROPERTIES, "true");
+    // servletProps.setProperty(ProxyServlet.P_USESYSTEMPROPERTIES, "true"); // Not supported with JDK HttpClient
     // Must use a non-local URL because localhost is in http.nonProxyHosts by default.
     targetBaseUri = "http://www.google.com";
     servletProps.setProperty(ProxyServlet.P_TARGET_URI, targetBaseUri);

From 7fb5af40028f9575e9a32f8f071ea322cfa16faf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 16 Nov 2025 19:59:01 +0000
Subject: [PATCH 08/15] Address additional code review feedback

- Extracted query parsing logic to parseQueryParams method in URITemplateProxyServlet
- Changed extractHost from private to protected in ProxyServlet to expose for subclasses
- Inlined extractHost call in URITemplateProxyServlet (removed intermediate variable)
- Simplified RequestInfoServlet to use transferTo() instead of manual buffer copying
- Simplified testRedirect to use replaceTargetServlet helper method
- Improved replaceTargetServlet to use delegating servlet pattern (no server restart needed)

Co-authored-by: dsmiley <377295+dsmiley@users.noreply.github.com>
---
 .../mitre/dsmiley/httpproxy/ProxyServlet.java |  2 +-
 .../httpproxy/URITemplateProxyServlet.java    | 51 ++++++++---------
 .../dsmiley/httpproxy/ProxyServletTest.java   | 56 ++++++++++---------
 3 files changed, 53 insertions(+), 56 deletions(-)

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index 9ff4531..a96468e 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -223,7 +223,7 @@ protected void initTarget() throws ServletException {
   /**
    * Extract host:port from URI
    */
-  private String extractHost(URI uri) {
+  protected String extractHost(URI uri) {
     String host = uri.getHost();
     int port = uri.getPort();
     if (port == -1) {
diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
index 1efe630..6ff0856 100644
--- a/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
@@ -91,25 +91,7 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
       queryString = queryString.substring(0, hash);
     }
     
-    LinkedHashMap<String, String> params = new LinkedHashMap<String, String>();
-    if (requestQueryString != null && !requestQueryString.isEmpty()) {
-      // Parse query string manually
-      String[] pairs = requestQueryString.split("&");
-      for (String pair : pairs) {
-        int idx = pair.indexOf("=");
-        if (idx > 0) {
-          String key = URLDecoder.decode(pair.substring(0, idx), StandardCharsets.UTF_8);
-          String value = URLDecoder.decode(pair.substring(idx + 1), StandardCharsets.UTF_8);
-          params.put(key, value);
-        } else if (idx == 0) {
-          // Ignore malformed parameter
-        } else {
-          // Parameter without value
-          String key = URLDecoder.decode(pair, StandardCharsets.UTF_8);
-          params.put(key, "");
-        }
-      }
-    }
+    LinkedHashMap<String, String> params = parseQueryParams(requestQueryString);
 
     //Now rewrite the URL
     StringBuffer urlBuf = new StringBuffer();//note: StringBuilder isn't supported by Matcher
@@ -131,8 +113,7 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     } catch (Exception e) {
       throw new ServletException("Rewritten targetUri is invalid: " + newTargetUri,e);
     }
-    String targetHost = extractHost(targetUriObj);
-    servletRequest.setAttribute(ATTR_TARGET_HOST, targetHost);
+    servletRequest.setAttribute(ATTR_TARGET_HOST, extractHost(targetUriObj));
 
     //Determine the new query string based on removing the used names
     StringBuilder newQueryBuf = new StringBuilder(queryString.length());
@@ -154,14 +135,28 @@ protected String rewriteQueryStringFromRequest(HttpServletRequest servletRequest
   }
   
   /**
-   * Extract host:port from URI (helper method)
+   * Parse query string into a map of key-value pairs
    */
-  private String extractHost(URI uri) {
-    String host = uri.getHost();
-    int port = uri.getPort();
-    if (port == -1) {
-      return host;
+  private LinkedHashMap<String, String> parseQueryParams(String requestQueryString) {
+    LinkedHashMap<String, String> params = new LinkedHashMap<String, String>();
+    if (requestQueryString != null && !requestQueryString.isEmpty()) {
+      // Parse query string manually
+      String[] pairs = requestQueryString.split("&");
+      for (String pair : pairs) {
+        int idx = pair.indexOf("=");
+        if (idx > 0) {
+          String key = URLDecoder.decode(pair.substring(0, idx), StandardCharsets.UTF_8);
+          String value = URLDecoder.decode(pair.substring(idx + 1), StandardCharsets.UTF_8);
+          params.put(key, value);
+        } else if (idx == 0) {
+          // Ignore malformed parameter
+        } else {
+          // Parameter without value
+          String key = URLDecoder.decode(pair, StandardCharsets.UTF_8);
+          params.put(key, "");
+        }
+      }
     }
-    return host + ":" + port;
+    return params;
   }
 }
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index 6ca063b..d08a20e 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -71,6 +71,7 @@ public class ProxyServletTest
    */
   protected Server targetServer;
   protected int targetServerPort;
+  protected DelegatingServlet delegatingServlet;
 
   /** From Meterware httpunit. */
   protected ServletRunner servletRunner;
@@ -84,11 +85,12 @@ public class ProxyServletTest
 
   @Before
   public void setUp() throws Exception {
-    // Start Jetty server as target
+    // Start Jetty server as target with a delegating servlet that can be updated
     targetServer = new Server(0);
     ServletHandler handler = new ServletHandler();
     targetServer.setHandler(handler);
-    handler.addServletWithMapping(RequestInfoServlet.class, "/targetPath/*");
+    delegatingServlet = new DelegatingServlet(new RequestInfoServlet());
+    handler.addServletWithMapping(new ServletHolder(delegatingServlet), "/targetPath/*");
     targetServer.start();
     targetServerPort = ((ServerConnector) targetServer.getConnectors()[0]).getLocalPort();
 
@@ -106,16 +108,30 @@ public void setUp() throws Exception {
   }
   
   /**
-   * Helper to restart target server with a custom servlet
+   * Helper to replace the target servlet handler without restarting the server
    */
-  protected void replaceTargetServlet(HttpServlet servlet) throws Exception {
-    targetServer.stop();
-    targetServer = new Server(targetServerPort);
-    ServletHandler handler = new ServletHandler();
-    targetServer.setHandler(handler);
-    ServletHolder holder = new ServletHolder(servlet);
-    handler.addServletWithMapping(holder, "/targetPath/*");
-    targetServer.start();
+  protected void replaceTargetServlet(HttpServlet servlet) {
+    delegatingServlet.setDelegate(servlet);
+  }
+  
+  /**
+   * Delegating servlet that can have its delegate updated at runtime
+   */
+  protected static class DelegatingServlet extends HttpServlet {
+    private HttpServlet delegate;
+    
+    public DelegatingServlet(HttpServlet delegate) {
+      this.delegate = delegate;
+    }
+    
+    public void setDelegate(HttpServlet delegate) {
+      this.delegate = delegate;
+    }
+    
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+      delegate.service(req, resp);
+    }
   }
 
   protected void setUpServlet(Properties servletProps) {
@@ -175,14 +191,7 @@ public void testPost() throws Exception {
   public void testRedirect() throws Exception {
     final String COOKIE_SET_HEADER = "Set-Cookie";
     
-    // Stop the target server and restart with redirect servlet
-    targetServer.stop();
-    targetServer = new Server(targetServerPort);
-    ServletHandler handler = new ServletHandler();
-    targetServer.setHandler(handler);
-    
-    // Add a redirect servlet
-    ServletHolder redirectHolder = new ServletHolder(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String targetHeader = request.getHeader("xxTarget");
@@ -193,8 +202,6 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
         }
       }
     });
-    handler.addServletWithMapping(redirectHolder, "/targetPath/*");
-    targetServer.start();
     
     GetMethodWebRequest request = makeGetMethodRequest(sourceBaseUri + "/%64%69%72%2F");
     assertRedirect(request, "/dummy", "/dummy");//TODO represents a bug to fix
@@ -733,12 +740,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
       pw.flush();//done with pw now
 
       // Copy request body
-      InputStream is = request.getInputStream();
-      byte[] buffer = new byte[8192];
-      int bytesRead;
-      while ((bytesRead = is.read(buffer)) != -1) {
-        baos.write(buffer, 0, bytesRead);
-      }
+      request.getInputStream().transferTo(baos);
 
       response.setStatus(200);
       response.setHeader("X-Reason", "TESTREASON");

From 01c7c3ec840c1dc8763e0cee35552670019f93b4 Mon Sep 17 00:00:00 2001
From: David Smiley <dsmiley@apache.org>
Date: Sun, 16 Nov 2025 16:03:41 -0500
Subject: [PATCH 09/15] improve

---
 .../mitre/dsmiley/httpproxy/ProxyServlet.java |  10 +-
 .../httpproxy/URITemplateProxyServlet.java    |   7 +-
 .../dsmiley/httpproxy/ProxyServletTest.java   | 119 +++++++-----------
 3 files changed, 53 insertions(+), 83 deletions(-)

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index a96468e..5dfbfba 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -51,7 +51,7 @@
  *
  * @author David Smiley dsmiley@apache.org
  */
-@SuppressWarnings({"deprecation", "serial", "WeakerAccess"})
+@SuppressWarnings({"deprecation", "WeakerAccess"})
 public class ProxyServlet extends HttpServlet {
 
   /* INIT PARAMETER NAME CONSTANTS */
@@ -189,10 +189,10 @@ public void init() throws ServletException {
   }
 
   /**
-   * Sub-classes can override specific behaviour of the HttpClient builder.
+   * Subclasses can override specific behavior of the HttpClient builder.
    */
   protected HttpClient.Builder buildClientBuilder() {
-    HttpClient.Builder builder = HttpClient.newBuilder();
+    HttpClient.Builder builder = newHttpClientBuilder();
     
     if (doHandleRedirects) {
       builder.followRedirects(HttpClient.Redirect.NORMAL);
@@ -223,7 +223,7 @@ protected void initTarget() throws ServletException {
   /**
    * Extract host:port from URI
    */
-  protected String extractHost(URI uri) {
+  protected static String extractHost(URI uri) {
     String host = uri.getHost();
     int port = uri.getPort();
     if (port == -1) {
@@ -261,7 +261,7 @@ protected HttpClient buildHttpClient(HttpClient.Builder clientBuilder) {
    *
    * @return HttpClient builder
    */
-  protected HttpClient.Builder getHttpClientBuilder() {
+  protected HttpClient.Builder newHttpClientBuilder() {
     return HttpClient.newBuilder();
   }
 
diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
index 6ff0856..d7c31b0 100644
--- a/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
@@ -21,7 +21,6 @@
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.net.URI;
-import java.net.URISyntaxException;
 import java.net.URLDecoder;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
@@ -94,7 +93,7 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     LinkedHashMap<String, String> params = parseQueryParams(requestQueryString);
 
     //Now rewrite the URL
-    StringBuffer urlBuf = new StringBuffer();//note: StringBuilder isn't supported by Matcher
+    StringBuilder urlBuf = new StringBuilder();
     Matcher matcher = TEMPLATE_PATTERN.matcher(targetUriTemplate);
     while (matcher.find()) {
       String arg = matcher.group(1);
@@ -122,7 +121,7 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
         newQueryBuf.append('&');
       newQueryBuf.append(nameVal.getKey()).append('=');
       if (nameVal.getValue() != null)
-        newQueryBuf.append( URLEncoder.encode(nameVal.getValue(), "UTF-8"));
+        newQueryBuf.append( URLEncoder.encode(nameVal.getValue(), StandardCharsets.UTF_8));
     }
     servletRequest.setAttribute(ATTR_QUERY_STRING, newQueryBuf.toString());
 
@@ -135,7 +134,7 @@ protected String rewriteQueryStringFromRequest(HttpServletRequest servletRequest
   }
   
   /**
-   * Parse query string into a map of key-value pairs
+   * Parse query string into a map of key-value pairs.  NOTE: doesn't handle repeated keys
    */
   private LinkedHashMap<String, String> parseQueryParams(String requestQueryString) {
     LinkedHashMap<String, String> params = new LinkedHashMap<String, String>();
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index d08a20e..46c280d 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -30,6 +30,7 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.UnknownHostException;
+import java.nio.charset.StandardCharsets;
 import java.util.Dictionary;
 import java.util.Enumeration;
 import java.util.Properties;
@@ -71,7 +72,9 @@ public class ProxyServletTest
    */
   protected Server targetServer;
   protected int targetServerPort;
-  protected DelegatingServlet delegatingServlet;
+  protected ServletHandler targetServletHandler;
+  protected ServletHolder targetServletHolder;
+
 
   /** From Meterware httpunit. */
   protected ServletRunner servletRunner;
@@ -87,10 +90,10 @@ public class ProxyServletTest
   public void setUp() throws Exception {
     // Start Jetty server as target with a delegating servlet that can be updated
     targetServer = new Server(0);
-    ServletHandler handler = new ServletHandler();
-    targetServer.setHandler(handler);
-    delegatingServlet = new DelegatingServlet(new RequestInfoServlet());
-    handler.addServletWithMapping(new ServletHolder(delegatingServlet), "/targetPath/*");
+    targetServletHandler = new ServletHandler();
+    targetServer.setHandler(targetServletHandler);
+    targetServletHolder = new ServletHolder(new RequestInfoServlet());
+    targetServletHandler.addServletWithMapping(targetServletHolder, "/targetPath/*");
     targetServer.start();
     targetServerPort = ((ServerConnector) targetServer.getConnectors()[0]).getLocalPort();
 
@@ -106,36 +109,8 @@ public void setUp() throws Exception {
     sc.getClientProperties().setAutoRedirect(false);//don't want httpunit itself to redirect
 
   }
-  
-  /**
-   * Helper to replace the target servlet handler without restarting the server
-   */
-  protected void replaceTargetServlet(HttpServlet servlet) {
-    delegatingServlet.setDelegate(servlet);
-  }
-  
-  /**
-   * Delegating servlet that can have its delegate updated at runtime
-   */
-  protected static class DelegatingServlet extends HttpServlet {
-    private HttpServlet delegate;
-    
-    public DelegatingServlet(HttpServlet delegate) {
-      this.delegate = delegate;
-    }
-    
-    public void setDelegate(HttpServlet delegate) {
-      this.delegate = delegate;
-    }
-    
-    @Override
-    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-      delegate.service(req, resp);
-    }
-  }
 
   protected void setUpServlet(Properties servletProps) {
-    servletProps.putAll(servletProps);
     targetBaseUri = "http://localhost:" + targetServerPort + "/targetPath";
     servletProps.setProperty("targetUri", targetBaseUri);
     servletRunner.registerServlet(servletPath + "/*", servletName, servletProps);//also matches /proxyMe (no path info)
@@ -153,7 +128,7 @@ public void tearDown() throws Exception {
   //note: we don't include fragments:   "/p?#f","/p?#" because
   //  user agents aren't supposed to send them. HttpComponents has behaved
   //  differently on sending them vs not sending them.
-  private static String[] testUrlSuffixes = new String[]{
+  private static final String[] testUrlSuffixes = new String[]{
           "","/pathInfo","/pathInfo/%23%25abc","?q=v","/p?q=v",
           "/p?query=note:Leitbild",//colon  Issue#4
           "/p?query=note%3ALeitbild",
@@ -190,11 +165,11 @@ public void testPost() throws Exception {
   @Test
   public void testRedirect() throws Exception {
     final String COOKIE_SET_HEADER = "Set-Cookie";
-    
-    replaceTargetServlet(new HttpServlet() {
+
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
-      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
-        String targetHeader = request.getHeader("xxTarget");
+      protected void service(HttpServletRequest request1, HttpServletResponse response) {
+        String targetHeader = request1.getHeader("xxTarget");
         if (targetHeader != null) {
           response.setHeader("Location", targetHeader);
           response.setHeader(COOKIE_SET_HEADER, "JSESSIONID=1234; path=/;");
@@ -202,7 +177,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
         }
       }
     });
-    
+
     GetMethodWebRequest request = makeGetMethodRequest(sourceBaseUri + "/%64%69%72%2F");
     assertRedirect(request, "/dummy", "/dummy");//TODO represents a bug to fix
     assertRedirect(request, targetBaseUri+"/dummy?a=b", sourceBaseUri+"/dummy?a=b");
@@ -234,7 +209,7 @@ public void testSendFile() throws Exception {
     //TODO test with url parameters (i.e. a=b); but HttpUnit is faulty so we can't
     final PostMethodWebRequest request = new PostMethodWebRequest(
             rewriteMakeMethodUrl("http://localhost/proxyMe"), true);//true: mime encoded
-    InputStream data = new ByteArrayInputStream("testFileData".getBytes("UTF-8"));
+    InputStream data = new ByteArrayInputStream("testFileData".getBytes(StandardCharsets.UTF_8));
     request.selectFile("fileNameParam", "fileName", data, "text/plain");
     WebResponse rsp = execAndAssert(request);
     assertTrue(rsp.getText().contains("Content-Type: multipart/form-data; boundary="));
@@ -247,14 +222,14 @@ public void testProxyWithUnescapedChars() throws Exception {
     execAssert(makeGetMethodRequest(sourceBaseUri + "/%5Babc%5D/xyz")); // already escaped brackets; don't escape twice
   }
 
-  /** http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html */
+  /** <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html">RFC2616</a> */
   @SuppressWarnings("unchecked")
   @Test
   public void testHopByHopHeadersOnSource() throws Exception {
     //"Proxy-Authenticate" is a hop-by-hop header
     final String HEADER = "Proxy-Authenticate";
-    
-    replaceTargetServlet(new HttpServlet() {
+
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         assertNull(request.getHeader(HEADER));
@@ -273,7 +248,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testWithExistingXForwardedFor() throws Exception {
     final String FOR_HEADER = "X-Forwarded-For";
 
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String xForwardedForHeader = request.getHeader(FOR_HEADER);
@@ -292,7 +267,7 @@ public void testEnabledXForwardedFor() throws Exception {
     final String FOR_HEADER = "X-Forwarded-For";
     final String PROTO_HEADER = "X-Forwarded-Proto";
 
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String xForwardedForHeader = request.getHeader(FOR_HEADER);
@@ -311,7 +286,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testCopyRequestHeaderToProxyRequest() throws Exception {
     final String HEADER = "HEADER_TO_TEST";
 
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String headerToTest = request.getHeader(HEADER);
@@ -330,7 +305,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testCopyProxiedRequestHeadersToResponse() throws Exception {
     final String HEADER = "HEADER_TO_TEST";
 
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "VALUE_TO_TEST");
@@ -347,7 +322,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   @Test
   public void testSetCookie() throws Exception {
     final String HEADER = "Set-Cookie";
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
@@ -364,7 +339,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   @Test
   public void testSetCookie2() throws Exception {
     final String HEADER = "Set-Cookie2";
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Max-Age=3600; Domain=.foo.bar.com; Secure");
@@ -394,7 +369,7 @@ public void testPreserveCookie() throws Exception {
     sc.getClientProperties().setAutoRedirect(false);//don't want httpunit itself to redirect
 
     final String HEADER = "Set-Cookie";
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
@@ -411,7 +386,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   @Test
   public void testSetCookieHttpOnly() throws Exception { //See GH #50
     final String HEADER = "Set-Cookie";
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want/; HttpOnly");
@@ -429,7 +404,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testSendCookiesToProxy() throws Exception {
     final StringBuffer captureCookieValue = new StringBuffer();
     final String HEADER = "Cookie";
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         captureCookieValue.append(request.getHeader(HEADER));
@@ -463,7 +438,7 @@ public void testPreserveCookiePath() throws Exception {
     sc.getClientProperties().setAutoRedirect(false);//don't want httpunit itself to redirect
 
     final String HEADER = "Set-Cookie";
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
@@ -486,7 +461,8 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testMultipleRequestsWithDiffCookies() throws Exception {
     final AtomicInteger requestCounter = new AtomicInteger(1);
     final StringBuffer captureCookieValue = new StringBuffer();
-    replaceTargetServlet(new HttpServlet() {
+    // there shouldn't be a cookie sent since each user request in this test is logging in for the first time
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         // there shouldn't be a cookie sent since each user request in this test is logging in for the first time
@@ -517,24 +493,19 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testRedirectWithBody() throws Exception {
     final String CONTENT = "-This-Shall-Not-Pass-";
     
-    // Stop and restart with a custom servlet for the redirect test
-    targetServer.stop();
-    targetServer = new Server(targetServerPort);
-    ServletHandler handler = new ServletHandler();
-    targetServer.setHandler(handler);
-    ServletHolder holder = new ServletHolder(new HttpServlet() {
-      @Override
-      protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
-        // Redirect to the requested URL with / appended
-        response.setHeader("Location", targetBaseUri + "/test/");
-        response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);
-        response.setHeader("Content-Type", "text/plain; charset=UTF-8");
-        // Set body of the response. We need it not-empty for the test.
-        response.getOutputStream().write(CONTENT.getBytes("UTF-8"));
-      }
-    });
-    handler.addServletWithMapping(holder, "/targetPath/test");
-    targetServer.start();
+    // Use a custom servlet for the redirect test
+    targetServletHandler.addServletWithMapping(
+        new ServletHolder(new HttpServlet() {
+          @Override
+          protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+            // Redirect to the requested URL with / appended
+            response.setHeader("Location", targetBaseUri + "/test/");
+            response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);
+            response.setHeader("Content-Type", "text/plain; charset=UTF-8");
+            // Set body of the response. We need it not-empty for the test.
+            response.getOutputStream().write(CONTENT.getBytes(StandardCharsets.UTF_8));
+          }
+        }), "/targetPath/test");
     GetMethodWebRequest req = makeGetMethodRequest(sourceBaseUri + "/test");
     // We expect a redirect with a / at the end
     WebResponse rsp = sc.getResponse(req);
@@ -564,7 +535,7 @@ public void testPreserveHost() throws Exception {
 
     final String HEADER = "Host";
     final String[] proxyHost = new String[1];
-    replaceTargetServlet(new HttpServlet() {
+    targetServletHolder.setServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
     	  proxyHost[0] = request.getHeader(HEADER);
@@ -636,7 +607,7 @@ protected WebResponse execAndAssert(WebRequest request, String expectedUri) thro
     String expectedFirstLine = "REQUESTLINE: "+(request instanceof GetMethodWebRequest ? "GET" : "POST");
     expectedFirstLine += " " + expectedTargetUri + " HTTP/1.1";
 
-    String firstTextLine = text.substring(0,text.indexOf(System.getProperty("line.separator")));
+    String firstTextLine = text.substring(0,text.indexOf(System.lineSeparator()));
 
     assertEquals(expectedFirstLine, firstTextLine);
 

From dd90a131e22abc2d70bb49d500c4cf28feb4c095 Mon Sep 17 00:00:00 2001
From: David Smiley <dsmiley@apache.org>
Date: Sun, 16 Nov 2025 21:27:37 -0500
Subject: [PATCH 10/15] ProxyServletTest passes

---
 .../mitre/dsmiley/httpproxy/ProxyServlet.java | 22 ++++----
 .../dsmiley/httpproxy/ProxyServletTest.java   | 52 +++++++++++--------
 2 files changed, 41 insertions(+), 33 deletions(-)

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index 5dfbfba..c64fe11 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -25,6 +25,7 @@
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.net.HttpCookie;
+import java.net.ProxySelector;
 import java.net.URI;
 import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
@@ -193,17 +194,17 @@ public void init() throws ServletException {
    */
   protected HttpClient.Builder buildClientBuilder() {
     HttpClient.Builder builder = newHttpClientBuilder();
-    
-    if (doHandleRedirects) {
-      builder.followRedirects(HttpClient.Redirect.NORMAL);
-    } else {
-      builder.followRedirects(HttpClient.Redirect.NEVER);
-    }
+
+    builder.followRedirects(doHandleRedirects
+        ? HttpClient.Redirect.NORMAL
+        : HttpClient.Redirect.NEVER);
     
     if (connectTimeout > 0) {
       builder.connectTimeout(Duration.ofMillis(connectTimeout));
     }
-    
+
+    builder.proxy(ProxySelector.getDefault());
+
     return builder;
   }
 
@@ -256,7 +257,7 @@ protected HttpClient buildHttpClient(HttpClient.Builder clientBuilder) {
   }
 
   /**
-   * Creates a {@code HttpClient.Builder}. Meant as preprocessor to possibly
+   * Creates a {@code HttpClient.Builder}. Meant as a pre-processor to possibly
    * adapt the client builder prior to any configuration got applied.
    *
    * @return HttpClient builder
@@ -309,7 +310,6 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     HttpRequest.BodyPublisher bodyPublisher;
     if (servletRequest.getHeader("Content-Length") != null ||
         servletRequest.getHeader("Transfer-Encoding") != null) {
-      long contentLength = getContentLength(servletRequest);
       bodyPublisher = HttpRequest.BodyPublishers.ofInputStream(() -> {
         try {
           return servletRequest.getInputStream();
@@ -330,10 +330,10 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
     
     // Copy request headers
     copyRequestHeaders(servletRequest, proxyRequestBuilder);
+
     setXForwardedForHeader(servletRequest, proxyRequestBuilder);
-    
+
     HttpRequest proxyRequest = proxyRequestBuilder.build();
-    
     HttpResponse<InputStream> proxyResponse = null;
     try {
       // Execute the request
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index 46c280d..fd0467b 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -88,7 +88,7 @@ public class ProxyServletTest
 
   @Before
   public void setUp() throws Exception {
-    // Start Jetty server as target with a delegating servlet that can be updated
+    // Start Jetty server as target
     targetServer = new Server(0);
     targetServletHandler = new ServletHandler();
     targetServer.setHandler(targetServletHandler);
@@ -97,6 +97,7 @@ public void setUp() throws Exception {
     targetServer.start();
     targetServerPort = ((ServerConnector) targetServer.getConnectors()[0]).getLocalPort();
 
+    System.setProperty("jdk.httpclient.allowRestrictedHeaders", "host");
     servletRunner = new ServletRunner();
 
     Properties servletProps = new Properties();
@@ -124,6 +125,12 @@ public void tearDown() throws Exception {
      targetServer.stop();
    }
   }
+  
+  protected void replaceTargetServlet(HttpServlet servlet) throws Exception {
+    targetServletHolder.stop();
+    targetServletHolder.setServlet(servlet);
+    targetServletHolder.start();
+  }
 
   //note: we don't include fragments:   "/p?#f","/p?#" because
   //  user agents aren't supposed to send them. HttpComponents has behaved
@@ -166,7 +173,7 @@ public void testPost() throws Exception {
   public void testRedirect() throws Exception {
     final String COOKIE_SET_HEADER = "Set-Cookie";
 
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request1, HttpServletResponse response) {
         String targetHeader = request1.getHeader("xxTarget");
@@ -229,7 +236,7 @@ public void testHopByHopHeadersOnSource() throws Exception {
     //"Proxy-Authenticate" is a hop-by-hop header
     final String HEADER = "Proxy-Authenticate";
 
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         assertNull(request.getHeader(HEADER));
@@ -248,7 +255,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testWithExistingXForwardedFor() throws Exception {
     final String FOR_HEADER = "X-Forwarded-For";
 
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String xForwardedForHeader = request.getHeader(FOR_HEADER);
@@ -267,7 +274,7 @@ public void testEnabledXForwardedFor() throws Exception {
     final String FOR_HEADER = "X-Forwarded-For";
     final String PROTO_HEADER = "X-Forwarded-Proto";
 
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String xForwardedForHeader = request.getHeader(FOR_HEADER);
@@ -286,7 +293,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testCopyRequestHeaderToProxyRequest() throws Exception {
     final String HEADER = "HEADER_TO_TEST";
 
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String headerToTest = request.getHeader(HEADER);
@@ -305,7 +312,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testCopyProxiedRequestHeadersToResponse() throws Exception {
     final String HEADER = "HEADER_TO_TEST";
 
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "VALUE_TO_TEST");
@@ -322,7 +329,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   @Test
   public void testSetCookie() throws Exception {
     final String HEADER = "Set-Cookie";
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
@@ -339,7 +346,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   @Test
   public void testSetCookie2() throws Exception {
     final String HEADER = "Set-Cookie2";
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Max-Age=3600; Domain=.foo.bar.com; Secure");
@@ -369,7 +376,7 @@ public void testPreserveCookie() throws Exception {
     sc.getClientProperties().setAutoRedirect(false);//don't want httpunit itself to redirect
 
     final String HEADER = "Set-Cookie";
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
@@ -386,7 +393,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   @Test
   public void testSetCookieHttpOnly() throws Exception { //See GH #50
     final String HEADER = "Set-Cookie";
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/dont/want/; HttpOnly");
@@ -404,7 +411,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   public void testSendCookiesToProxy() throws Exception {
     final StringBuffer captureCookieValue = new StringBuffer();
     final String HEADER = "Cookie";
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         captureCookieValue.append(request.getHeader(HEADER));
@@ -438,13 +445,15 @@ public void testPreserveCookiePath() throws Exception {
     sc.getClientProperties().setAutoRedirect(false);//don't want httpunit itself to redirect
 
     final String HEADER = "Set-Cookie";
-    targetServletHolder.setServlet(new HttpServlet() {
+    targetServletHolder.stop();
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         response.setHeader(HEADER, "JSESSIONID=1234; Path=/proxy/path/that/we/want; Expires=Wed, 13 Jan 2021 22:23:01 GMT; Domain=.foo.bar.com; HttpOnly");
         new RequestInfoServlet().service(request, response);
       }
     });
+    targetServletHolder.start();
 
     GetMethodWebRequest req = makeGetMethodRequest(sourceBaseUri);
     WebResponse rsp = execAndAssert(req, "");
@@ -462,7 +471,7 @@ public void testMultipleRequestsWithDiffCookies() throws Exception {
     final AtomicInteger requestCounter = new AtomicInteger(1);
     final StringBuffer captureCookieValue = new StringBuffer();
     // there shouldn't be a cookie sent since each user request in this test is logging in for the first time
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         // there shouldn't be a cookie sent since each user request in this test is logging in for the first time
@@ -535,7 +544,7 @@ public void testPreserveHost() throws Exception {
 
     final String HEADER = "Host";
     final String[] proxyHost = new String[1];
-    targetServletHolder.setServlet(new HttpServlet() {
+    replaceTargetServlet(new HttpServlet() {
       @Override
       protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
     	  proxyHost[0] = request.getHeader(HEADER);
@@ -550,14 +559,12 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   }
 
   @Test
-  @org.junit.Ignore("P_USESYSTEMPROPERTIES not supported with JDK HttpClient")
-  public void testUseSystemProperties() throws Exception {
+  public void testHttpProxy() throws Exception {
     System.setProperty("http.proxyHost", "foo.blah.nonexisting.dns.name");
     servletRunner = new ServletRunner();
 
     Properties servletProps = new Properties();
     servletProps.setProperty(ProxyServlet.P_LOG, "true");
-    // servletProps.setProperty(ProxyServlet.P_USESYSTEMPROPERTIES, "true"); // Not supported with JDK HttpClient
     // Must use a non-local URL because localhost is in http.nonProxyHosts by default.
     targetBaseUri = "http://www.google.com";
     servletProps.setProperty(ProxyServlet.P_TARGET_URI, targetBaseUri);
@@ -570,7 +577,8 @@ public void testUseSystemProperties() throws Exception {
     try {
       execAssert(req);
       fail("UnknownHostException expected.");
-    } catch (UnknownHostException e) {
+    } catch (Exception e) {
+      System.out.println(e.toString());
       // Expected assuming that our proxy host defined above does not exist.
     } finally {
       System.clearProperty("http.proxyHost");
@@ -710,12 +718,12 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
       pw.println("BODY: (below)");
       pw.flush();//done with pw now
 
-      // Copy request body
-      request.getInputStream().transferTo(baos);
-
       response.setStatus(200);
       response.setHeader("X-Reason", "TESTREASON");
       response.setContentType("text/plain");
+
+      // Copy request body
+      request.getInputStream().transferTo(baos);
       response.setContentLength(baos.size());
       response.getOutputStream().write(baos.toByteArray());
     }

From cf9e4837e2a196d4c443b3dcdbca3e18e5fd8560 Mon Sep 17 00:00:00 2001
From: David Smiley <dsmiley@apache.org>
Date: Sun, 16 Nov 2025 21:56:45 -0500
Subject: [PATCH 11/15] more

---
 .../mitre/dsmiley/httpproxy/ProxyServlet.java |  13 +-
 .../httpproxy/URITemplateProxyServlet.java    |   4 +-
 .../httpproxy/ParallelConnectionsTest.java    | 141 ------------------
 .../dsmiley/httpproxy/ProxyServletTest.java   |  37 +++--
 4 files changed, 21 insertions(+), 174 deletions(-)
 delete mode 100644 src/test/java/org/mitre/dsmiley/httpproxy/ParallelConnectionsTest.java

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index c64fe11..6abfb14 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -47,7 +47,7 @@
  *   portable across servlet engines, and is embeddable into another web application.
  * </p>
  * <p>
- *   Inspiration: http://httpd.apache.org/docs/2.0/mod/mod_proxy.html
+ *   Inspiration: <a href="http://httpd.apache.org/docs/2.0/mod/mod_proxy.html">mod_proxy</a>
  * </p>
  *
  * @author David Smiley dsmiley@apache.org
@@ -372,17 +372,6 @@ protected void service(HttpServletRequest servletRequest, HttpServletResponse se
   }
 
   protected void handleRequestException(HttpRequest proxyRequest, HttpResponse<InputStream> proxyResponse, Exception e) throws ServletException, IOException {
-    // If the response is a chunked response, it is read to completion when
-    // #close is called. If the sending site does not timeout or keeps sending,
-    // the connection will be kept open indefinitely. Closing the response
-    // object terminates the stream.
-    if (proxyResponse != null && proxyResponse.body() != null) {
-      try {
-        proxyResponse.body().close();
-      } catch (IOException ex) {
-        // Ignore
-      }
-    }
     if (e instanceof RuntimeException)
       throw (RuntimeException)e;
     if (e instanceof ServletException)
diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
index d7c31b0..e9b4635 100644
--- a/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/URITemplateProxyServlet.java
@@ -134,10 +134,10 @@ protected String rewriteQueryStringFromRequest(HttpServletRequest servletRequest
   }
   
   /**
-   * Parse query string into a map of key-value pairs.  NOTE: doesn't handle repeated keys
+   * Parse a query string into a map of key-value pairs.  NOTE: doesn't handle repeated keys
    */
   private LinkedHashMap<String, String> parseQueryParams(String requestQueryString) {
-    LinkedHashMap<String, String> params = new LinkedHashMap<String, String>();
+    LinkedHashMap<String, String> params = new LinkedHashMap<>();
     if (requestQueryString != null && !requestQueryString.isEmpty()) {
       // Parse query string manually
       String[] pairs = requestQueryString.split("&");
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ParallelConnectionsTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ParallelConnectionsTest.java
deleted file mode 100644
index 0fb367a..0000000
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ParallelConnectionsTest.java
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright 2020 Matthias Bläsing.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.mitre.dsmiley.httpproxy;
-
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.io.OutputStreamWriter;
-import java.net.URL;
-import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.Callable;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServlet;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-
-import org.eclipse.jetty.server.Server;
-import org.eclipse.jetty.server.ServerConnector;
-import org.eclipse.jetty.servlet.ServletHandler;
-import org.eclipse.jetty.servlet.ServletHolder;
-import org.junit.After;
-import static org.junit.Assert.assertEquals;
-import org.junit.Before;
-import org.junit.Test;
-
-public class ParallelConnectionsTest {
-
-  private Server server;
-  private ServletHandler servletHandler;
-  private int serverPort;
-
-  @Before
-  public void setUp() throws Exception {
-    server = new Server(0);
-    servletHandler = new ServletHandler();
-    server.setHandler(servletHandler);
-    server.start();
-
-    serverPort = ((ServerConnector) server.getConnectors()[0]).getLocalPort();
-  }
-
-  @After
-  public void tearDown() throws Exception {
-    server.stop();
-    serverPort = -1;
-  }
-
-  @Test
-  @org.junit.Ignore("P_MAXCONNECTIONS not supported with JDK HttpClient")
-  public void testHandlingMultipleConnectionsSameRoute() throws Exception {
-    /*
-     This test ensures, that a minimum nunmber of parallel connections can be
-     established. The test works by opening "parallelConnectionsToTest"
-     connections, this is enforced by a countdownlatch, that ensures, that all
-     connections to the backend are established before they are served by the
-     demo servlet.
-     */
-
-    int parallelConnectionsToTest = 10;
-
-    ServletHolder servletHolder = servletHandler.addServletWithMapping(ProxyServlet.class, "/sampleBackendProxied/*");
-    servletHolder.setInitParameter(ProxyServlet.P_LOG, "true");
-    // servletHolder.setInitParameter(ProxyServlet.P_MAXCONNECTIONS, Integer.toString(parallelConnectionsToTest)); // Not supported with JDK HttpClient
-    servletHolder.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/sampleBackend/", serverPort));
-
-    CountDownLatch requestsReceived = new CountDownLatch(parallelConnectionsToTest);
-
-    ServletHolder dummyBackend = new ServletHolder(new HttpServlet() {
-      @Override
-      protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        try {
-          // The latch ensures, that all servlets wait until all expected
-          // connections are made. Only after all clients have connected, the
-          // request is fullfilled.
-          requestsReceived.countDown();
-          if (requestsReceived.await(10, TimeUnit.SECONDS)) {
-            resp.setHeader("Content-Type", "text/plain; charset=utf-8");
-            OutputStream os = resp.getOutputStream();
-            OutputStreamWriter osw = new OutputStreamWriter(os, StandardCharsets.UTF_8);
-            osw.write("Works");
-            osw.flush();
-          }
-        } catch (InterruptedException ex) {
-          throw new IOException(ex);
-        }
-      }
-    });
-    servletHandler.addServletWithMapping(dummyBackend, "/sampleBackend/*");
-
-    URL url = new URL(String.format("http://localhost:%d/sampleBackendProxied/test", serverPort));
-
-    ExecutorService es = Executors.newFixedThreadPool(parallelConnectionsToTest);
-
-    class Client implements Callable<String> {
-      @Override
-      public String call() throws Exception {
-        try (InputStream is = url.openStream();
-                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-          byte[] buffer = new byte[10 * 1024];
-          int read;
-          while((read = is.read(buffer)) > 0) {
-            baos.write(buffer, 0, read);
-          }
-          return baos.toString("UTF-8");
-        }
-      }
-    }
-
-    List<Future<String>> result = new ArrayList<>(parallelConnectionsToTest);
-
-    for(int i = 0; i < parallelConnectionsToTest; i++) {
-      result.add(es.submit(new Client()));
-    }
-
-    for(Future<String> f: result) {
-      assertEquals("Works", f.get());
-    }
-  }
-}
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index fd0467b..117129d 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -21,6 +21,16 @@
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
+import com.meterware.httpunit.GetMethodWebRequest;
+import com.meterware.httpunit.PostMethodWebRequest;
+import com.meterware.httpunit.WebRequest;
+import com.meterware.httpunit.WebResponse;
+import com.meterware.servletunit.ServletRunner;
+import com.meterware.servletunit.ServletUnitClient;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -29,18 +39,11 @@
 import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
-import java.net.UnknownHostException;
 import java.nio.charset.StandardCharsets;
 import java.util.Dictionary;
 import java.util.Enumeration;
 import java.util.Properties;
 import java.util.concurrent.atomic.AtomicInteger;
-
-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServlet;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.eclipse.jetty.server.Server;
@@ -52,15 +55,8 @@
 import org.junit.Test;
 import org.xml.sax.SAXException;
 
-import com.meterware.httpunit.GetMethodWebRequest;
-import com.meterware.httpunit.PostMethodWebRequest;
-import com.meterware.httpunit.WebRequest;
-import com.meterware.httpunit.WebResponse;
-import com.meterware.servletunit.ServletRunner;
-import com.meterware.servletunit.ServletUnitClient;
-
 /**
- * @author David Smiley - dsmiley@mitre.org
+ * @author David Smiley - dsmiley@apache.org
  */
 @SuppressWarnings({ "deprecation", "rawtypes" })
 public class ProxyServletTest
@@ -506,7 +502,8 @@ public void testRedirectWithBody() throws Exception {
     targetServletHandler.addServletWithMapping(
         new ServletHolder(new HttpServlet() {
           @Override
-          protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+          protected void service(HttpServletRequest request, HttpServletResponse response) throws
+              IOException {
             // Redirect to the requested URL with / appended
             response.setHeader("Location", targetBaseUri + "/test/");
             response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);
@@ -559,7 +556,7 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
   }
 
   @Test
-  public void testHttpProxy() throws Exception {
+  public void testHttpProxy() {
     System.setProperty("http.proxyHost", "foo.blah.nonexisting.dns.name");
     servletRunner = new ServletRunner();
 
@@ -578,7 +575,8 @@ public void testHttpProxy() throws Exception {
       execAssert(req);
       fail("UnknownHostException expected.");
     } catch (Exception e) {
-      System.out.println(e.toString());
+      System.out.println("expected exception, assuming confused by bogus proxy host");
+      e.printStackTrace(System.out);
       // Expected assuming that our proxy host defined above does not exist.
     } finally {
       System.clearProperty("http.proxyHost");
@@ -699,7 +697,8 @@ protected String rewriteMakeMethodUrl(String url) {
   public static class RequestInfoServlet extends HttpServlet
   {
     @Override
-    protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+    protected void service(HttpServletRequest request, HttpServletResponse response) throws
+        IOException {
       ByteArrayOutputStream baos = new ByteArrayOutputStream();
       PrintWriter pw = new PrintWriter(baos,false);
       

From 77576002f2cbef9aa9275f9e789c7045f1daf304 Mon Sep 17 00:00:00 2001
From: David Smiley <dsmiley@apache.org>
Date: Sun, 16 Nov 2025 22:34:06 -0500
Subject: [PATCH 12/15] Fix AcceptEncodingTest (gzip)

---
 .../org/mitre/dsmiley/httpproxy/ProxyServlet.java | 15 ++++++++++-----
 .../dsmiley/httpproxy/AcceptEncodingTest.java     |  6 ++++--
 .../dsmiley/httpproxy/ChunkedTransferTest.java    |  6 ++++--
 3 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index 6abfb14..8bf326e 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -52,7 +52,7 @@
  *
  * @author David Smiley dsmiley@apache.org
  */
-@SuppressWarnings({"deprecation", "WeakerAccess"})
+@SuppressWarnings({"WeakerAccess"})
 public class ProxyServlet extends HttpServlet {
 
   /* INIT PARAMETER NAME CONSTANTS */
@@ -425,6 +425,12 @@ protected void copyRequestHeaders(HttpServletRequest servletRequest, HttpRequest
       String headerName = enumerationOfHeaderNames.nextElement();
       copyRequestHeader(servletRequest, proxyRequest, headerName);
     }
+
+    // If compression is handled by the servlet, add Accept-Encoding header for JDK HttpClient
+    // JDK HttpClient doesn't automatically add this like Apache HttpClient did
+    if (doHandleCompression) {
+      proxyRequest.header("Accept-Encoding", "gzip");
+    }
   }
 
   /**
@@ -443,7 +449,6 @@ protected void copyRequestHeader(HttpServletRequest servletRequest, HttpRequest.
     if (doHandleCompression && headerName.equalsIgnoreCase("Accept-Encoding"))
       return;
 
-    @SuppressWarnings("unchecked")
     Enumeration<String> headers = servletRequest.getHeaders(headerName);
     while (headers.hasMoreElements()) {//sometimes more than one value
       String headerValue = headers.nextElement();
@@ -603,7 +608,7 @@ protected void copyResponseEntity(HttpResponse<InputStream> proxyResponse, HttpS
     if (entity != null) {
       // Check if chunked based on headers
       List<String> transferEncoding = proxyResponse.headers().allValues("Transfer-Encoding");
-      boolean isChunked = transferEncoding.stream().anyMatch(te -> te.toLowerCase().contains("chunked"));
+      boolean isChunked = transferEncoding.stream().anyMatch(te -> te.toLowerCase(Locale.ROOT).contains("chunked"));
       
       if (isChunked) {
         // Flush intermediate results before blocking on input -- needed for SSE
@@ -614,7 +619,7 @@ protected void copyResponseEntity(HttpResponse<InputStream> proxyResponse, HttpS
         while ((read = is.read(buffer)) != -1) {
           os.write(buffer, 0, read);
           /*-
-           * Issue in JDK HttpClient: if the stream from client is
+           * if the stream from client is
            * compressed, it may delegate to GzipInputStream.
            * The #available implementation of InflaterInputStream (parent of
            * GzipInputStream) return 1 until EOF is reached. This is not
@@ -624,7 +629,7 @@ protected void copyResponseEntity(HttpResponse<InputStream> proxyResponse, HttpS
            *   but may read or skip fewer bytes.
            *
            *  To work around this, a flush is issued always if compression
-            *  is handled by the http client
+           *  is handled by the http client
            */
           if (doHandleCompression || is.available() == 0 /* next is.read will block */) {
             os.flush();
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/AcceptEncodingTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/AcceptEncodingTest.java
index b30c85d..0427a56 100644
--- a/src/test/java/org/mitre/dsmiley/httpproxy/AcceptEncodingTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/AcceptEncodingTest.java
@@ -47,6 +47,8 @@ public class AcceptEncodingTest {
 
   @Before
   public void setUp() throws Exception {
+    System.setProperty("jdk.httpclient.allowRestrictedHeaders", "host");
+
     server = new Server(0);
     servletHandler = new ServletHandler();
     Handler serverHandler = servletHandler;
@@ -80,12 +82,12 @@ public void testHandlingAcceptEncodingHeader() throws Exception {
 
     ServletHolder servletHolder = servletHandler.addServletWithMapping(ProxyServlet.class, "/acceptEncodingProxyHandleCompression/*");
     servletHolder.setInitParameter(ProxyServlet.P_LOG, "true");
-    servletHolder.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/acceptEncoding/", serverPort));
+    servletHolder.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/acceptEncoding", serverPort));
     servletHolder.setInitParameter(ProxyServlet.P_HANDLECOMPRESSION, Boolean.TRUE.toString());
 
     ServletHolder servletHolder2 = servletHandler.addServletWithMapping(ProxyServlet.class, "/acceptEncodingProxy/*");
     servletHolder2.setInitParameter(ProxyServlet.P_LOG, "true");
-    servletHolder2.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/acceptEncoding/", serverPort));
+    servletHolder2.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/acceptEncoding", serverPort));
     servletHolder2.setInitParameter(ProxyServlet.P_HANDLECOMPRESSION, Boolean.FALSE.toString());
 
     ServletHolder dummyBackend = new ServletHolder(new HttpServlet() {
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ChunkedTransferTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ChunkedTransferTest.java
index 5be4e53..e2ecc3b 100644
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ChunkedTransferTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ChunkedTransferTest.java
@@ -73,6 +73,8 @@ public ChunkedTransferTest(boolean supportBackendCompression, boolean handleComp
 
   @Before
   public void setUp() throws Exception {
+    System.setProperty("jdk.httpclient.allowRestrictedHeaders", "host");
+
     server = new Server(0);
     servletHandler = new ServletHandler();
     Handler serverHandler = servletHandler;
@@ -120,7 +122,7 @@ public void testChunkedTransfer() throws Exception {
 
     ServletHolder servletHolder = servletHandler.addServletWithMapping(ProxyServlet.class, "/chatProxied/*");
     servletHolder.setInitParameter(ProxyServlet.P_LOG, "true");
-    servletHolder.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/chat/", serverPort));
+    servletHolder.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/chat", serverPort));
     servletHolder.setInitParameter(ProxyServlet.P_HANDLECOMPRESSION, Boolean.toString(handleCompressionApacheClient));
 
     ServletHolder dummyBackend = new ServletHolder(new HttpServlet() {
@@ -183,7 +185,7 @@ when the closing of the proxy (frontend) connection is detected.
 
     ServletHolder servletHolder = servletHandler.addServletWithMapping(ProxyServlet.class, "/chatProxied/*");
     servletHolder.setInitParameter(ProxyServlet.P_LOG, "true");
-    servletHolder.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/chat/", serverPort));
+    servletHolder.setInitParameter(ProxyServlet.P_TARGET_URI, String.format("http://localhost:%d/chat", serverPort));
     servletHolder.setInitParameter(ProxyServlet.P_HANDLECOMPRESSION, Boolean.toString(handleCompressionApacheClient));
 
     ServletHolder dummyBackend = new ServletHolder(new HttpServlet() {

From 48fff949d260de7407fff0ceed94c5aa3805579b Mon Sep 17 00:00:00 2001
From: David Smiley <dsmiley@apache.org>
Date: Sun, 16 Nov 2025 22:43:11 -0500
Subject: [PATCH 13/15] entity/inputStream

---
 .../org/mitre/dsmiley/httpproxy/ProxyServlet.java     | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index 8bf326e..6f0f089 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -604,19 +604,18 @@ protected String getCookieNamePrefix(String name) {
   protected void copyResponseEntity(HttpResponse<InputStream> proxyResponse, HttpServletResponse servletResponse,
                                     HttpRequest proxyRequest, HttpServletRequest servletRequest)
           throws IOException {
-    InputStream entity = proxyResponse.body();
-    if (entity != null) {
+    InputStream inputStream = proxyResponse.body(); // will be closed by caller
+    if (inputStream != null) {
       // Check if chunked based on headers
       List<String> transferEncoding = proxyResponse.headers().allValues("Transfer-Encoding");
       boolean isChunked = transferEncoding.stream().anyMatch(te -> te.toLowerCase(Locale.ROOT).contains("chunked"));
       
       if (isChunked) {
         // Flush intermediate results before blocking on input -- needed for SSE
-        InputStream is = entity;
         OutputStream os = servletResponse.getOutputStream();
         byte[] buffer = new byte[10 * 1024];
         int read;
-        while ((read = is.read(buffer)) != -1) {
+        while ((read = inputStream.read(buffer)) != -1) {
           os.write(buffer, 0, read);
           /*-
            * if the stream from client is
@@ -631,14 +630,14 @@ protected void copyResponseEntity(HttpResponse<InputStream> proxyResponse, HttpS
            *  To work around this, a flush is issued always if compression
            *  is handled by the http client
            */
-          if (doHandleCompression || is.available() == 0 /* next is.read will block */) {
+          if (doHandleCompression || inputStream.available() == 0 /* next is.read will block */) {
             os.flush();
           }
         }
         // Entity closing/cleanup is done in the caller (#service)
       } else {
         OutputStream servletOutputStream = servletResponse.getOutputStream();
-        entity.transferTo(servletOutputStream);
+        inputStream.transferTo(servletOutputStream);
       }
     }
   }

From f8d1bdc1a254d37cc2f013b5eba8699079ed3fc6 Mon Sep 17 00:00:00 2001
From: David Smiley <dsmiley@apache.org>
Date: Sun, 16 Nov 2025 22:51:58 -0500
Subject: [PATCH 14/15] set "allowRestrictedHeaders" to "host"

---
 src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java | 6 ++++++
 .../java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java  | 1 -
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index 6f0f089..2082c47 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -186,6 +186,12 @@ public void init() throws ServletException {
 
     initTarget();//sets target*
 
+    // restricts this for some reason
+    String allowRestrictedHeadersProp = "jdk.httpclient.allowRestrictedHeaders";
+    if (System.getProperty(allowRestrictedHeadersProp) == null) {
+      System.setProperty(allowRestrictedHeadersProp, "host");
+    }
+
     proxyClient = createHttpClient();
   }
 
diff --git a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
index 117129d..344986a 100755
--- a/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
+++ b/src/test/java/org/mitre/dsmiley/httpproxy/ProxyServletTest.java
@@ -93,7 +93,6 @@ public void setUp() throws Exception {
     targetServer.start();
     targetServerPort = ((ServerConnector) targetServer.getConnectors()[0]).getLocalPort();
 
-    System.setProperty("jdk.httpclient.allowRestrictedHeaders", "host");
     servletRunner = new ServletRunner();
 
     Properties servletProps = new Properties();

From 27b86b96055f9e999f178c87d365b52bed903542 Mon Sep 17 00:00:00 2001
From: David Smiley <dsmiley@apache.org>
Date: Sun, 16 Nov 2025 23:48:51 -0500
Subject: [PATCH 15/15] don't set default proxy (no need)

---
 .../org/mitre/dsmiley/httpproxy/ProxyServlet.java    | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
index 2082c47..3acd7ff 100755
--- a/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
+++ b/src/main/java/org/mitre/dsmiley/httpproxy/ProxyServlet.java
@@ -186,8 +186,8 @@ public void init() throws ServletException {
 
     initTarget();//sets target*
 
-    // restricts this for some reason
-    String allowRestrictedHeadersProp = "jdk.httpclient.allowRestrictedHeaders";
+    // the JDK restricts this for some reason
+    String allowRestrictedHeadersProp = "jdk.httpclient.allowRestrictedHeaders"; // comma delim
     if (System.getProperty(allowRestrictedHeadersProp) == null) {
       System.setProperty(allowRestrictedHeadersProp, "host");
     }
@@ -209,8 +209,6 @@ protected HttpClient.Builder buildClientBuilder() {
       builder.connectTimeout(Duration.ofMillis(connectTimeout));
     }
 
-    builder.proxy(ProxySelector.getDefault());
-
     return builder;
   }
 
@@ -411,8 +409,9 @@ private long getContentLength(HttpServletRequest request) {
     return -1L;
   }
 
-  /** These are the "hop-by-hop" headers that should not be copied.
-   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
+  /**
+   * These are the "hop-by-hop" headers that should not be copied.
+   * <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html">RFC-2616</a>
    */
   protected static final Set<String> hopByHopHeaders = Set.of(
       "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
@@ -425,7 +424,6 @@ private long getContentLength(HttpServletRequest request) {
    */
   protected void copyRequestHeaders(HttpServletRequest servletRequest, HttpRequest.Builder proxyRequest) {
     // Get an Enumeration of all of the header names sent by the client
-    @SuppressWarnings("unchecked")
     Enumeration<String> enumerationOfHeaderNames = servletRequest.getHeaderNames();
     while (enumerationOfHeaderNames.hasMoreElements()) {
       String headerName = enumerationOfHeaderNames.nextElement();